Falco: Falco 0.21.0 not available in stable deb

[natalysheinin]

When I try to install falco 0.21.0:
(apt-get install -y --no-install-recommends falco=$FALCO_VERSION)

I get:
E: Version '0.21.0' for 'falco' was not found

When I check available falco versions:
apt list -a falco

I get:

falco/stable-amd64 0.20.0+d77080a amd64
falco/stable-amd64 0.19.0 amd64
falco/stable-amd64 0.18.0 amd64
falco/stable-amd64 0.17.1 amd64
falco/stable-amd64 0.17.0 amd64

How to reproduce it

Try to build a dockerfile based for ubuntu/debian using falco version 0.21.0.

Expected behaviour

Dockerfile builds successfully with no error messages.

Screenshots

Environment

• Falco version:
  0.21.0
• System info:
  Ubuntu
• OS:
  Ubuntu Bionic
• Installation method:
  DEB stable

[leodido]

Hello @natalysheinin we recently started using new repositories for Falco packages.

Updated docs are here.

Briefly, the instructions are:

curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
echo "deb https://dl.bintray.com/falcosecurity/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
apt-get update -y
apt-get -y install linux-headers-$(uname -r)
apt-get install -y falco

This should install Falco 0.21.0

Could you please try those instructions?

[natalysheinin]

Thanks @leodido

I am able to install 0.21.0 now, but it seems that the kernel headers are not available.

E: Unable to locate package linux-headers-4.19.76-linuxkit
E: Couldn't find any package by glob 'linux-headers-4.19.76-linuxkit'
E: Couldn't find any package by regex 'linux-headers-4.19.76-linuxkit'

[fntlnz]

@natalysheinin - unfortunately getting Falco to work with the kernel module under Docker for desktop is still under investigation right now.

I was working on this with @leodido but we got stuck because the build of that system is not an open process and they are using the gcc RANDSTRUCT plugin and because of that we need a seed we don’t have to let us build the module for that specific kernel.

Back to the headers, they are probably somewhere in the base VM up in docker for desktop but no apt repository ships them (because they belong to the linuxkit os shipped by docker)

I’m on my mobile now so I don’t really know where to find the headers on the base system but to investigate that I would go up in the vm with a:

docker run —privileged —net=host —pid=host —rm -it debian:jessie nsenter -t 1 -m -n -p -u sh

Disclaimer: the command might not work, I just typed it on my phone and might not be accurate.

[leodido]

Yeah, obtaining a Falco kernel module for Docker for desktop (which uses linuxkit under the hoods) is still an on-going effort.

More about that in https://github.com/falcosecurity/driverkit/issues/22 and into driverkit feat/linuxkit branch.

[fntlnz]

I'm closing this since the initial issue was solved by using the new repositories in the docs.
@natalysheinin feel free to open other issues for tracking the other problems you are seeing if that's the case.

/close

[poiana]

@fntlnz: Closing this issue.

In response to this:

I'm closing this since the initial issue was solved by using the new repositories in the docs.
@natalysheinin feel free to open other issues for tracking the other problems you are seeing if that's the case.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.