Falco: Support Falco running with sandboxed runtimes

[egernst]

Motivation

Falco is great. I want Falco. But I also want to run the workload using a sandboxed runtime like kata containers. I hate choosing; I want both things.

Feature

It'd be awesome to be able to run either the kernel module or eBPF inside the guest kernel and have this available for Falco on the host. From taking a quick look @ https://sysdig.com/blog/understanding-common-library-implementation/, I'm hopeful that this is feasible, and we could have SCAP <-> sinsp communication occur over vsock between the guest/host.

Alternatives

I have to choose either Falco or sandboxed runtime.

Additional context

I haven't spent a lot of time yet looking through Falco yet, but before investing I am interested in high-level feedback like:

• "Yes, this is a good idea, very straight-forward"
• "no this doesn't make any sense"
• something in between.

[Ares3266]

+1 this - we run a lot of gVisor workloads _because_ they're higher risk, and so getting insights into these would be awesome

[leogr]

I think this is something we should discuss during our community call.

Please join us if you want!

[terenceli]

Hi,
I'm also very interested in this feature request.
Any update information?

[egernst]

I'll join a future community call. Thanks @leogr !

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[pidydx]

Has there been any discussion or movement on this?