Security In the Cloud With Falco: Overview And Project Updates
summary
Falco now ships official ARM64 packages, adds gVisor integration to observe sandboxed workloads, and offers a next‑gen eBPF probe that claims better performance than the classic kernel module. The plugin system supports multiple sources (including CloudTrail), rules and plugins are published as OCI‑distributed rules, libraries move to explicit user/kernel versioning to avoid breaking changes, Helm charts and an up‑to‑date kernel/distribution matrix simplify installs, and end‑to‑end tests and signing are being added to reduce surprises.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:17How does Falco work?
- 4:15Event Sources: Before Falco 0.31
- 5:11Event Sources: After Falco 0.33
- 7:04what is it?
- 9:43Security Rules
- 11:52Libraries and Driver versioning
- 15:13Kernel Crawler: a New Tool
- 16:46Kernel Crawler: Sneak Peek
- 17:21Plugin Updates
- 19:20Governance Improvements
- 26:14Thank you!
related talks
30mIn the Eye of Falco: Transforming Your View of Linux Kernel Security
47mFalco Conquering Cloud Security
38mIntro: Falco
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
01h 33mCloud Native Runtime Security with Falco
54mResponding to security events on Kubernetes, let's build a Security..
38mIntro: Falco
36mIntro: Falco