Falco on Ubuntu 24.04 LTS

Falco is the graduated Cloud Native Computing Foundation project for runtime threat detection. It taps the kernel's syscall stream, enriches each event with process, user and file context, and evaluates the result against a behavioural rule set, alerting the moment a process does something an intruder would do. This cloudimg image runs Falco 0.44.1 on Ubuntu 24.04 LTS, installed unmodified from the Falco project's own signed apt archive, so unattended upgrades keep the engine current rather than frozen at capture.

Behaviour, not signatures. Vulnerability scanning tells you what could be exploited and network controls tell you what reached the machine, but neither tells you what an intruder is doing on a host that is already running. Falco fills exactly that gap. Its bundled rules cover credentials files being read by untrusted programs, shells spawning where none should exist, kernel modules being loaded, ptrace attaching to running processes, new binaries written and immediately executed, cloud credentials being searched for and container escapes. Because the rules describe behaviour, they keep working against tooling nobody has catalogued yet, and every alert carries MITRE ATT&CK tags.

The driver choice is the one that matters, and this image gets it right. Falco can run on a DKMS-built kernel module or on a modern eBPF probe. The module is compiled against the running kernel, so the first time a machine installs a new kernel and reboots the sensor silently stops seeing events while still reporting healthy. This image ships the modern eBPF driver, which is relocated at load time against the running kernel and needs no compiler, no kernel headers and no DKMS. No kernel module is ever built or loaded, and that is verified on a freshly captured machine, not merely at build time.

Nothing to leak, nothing exposed. Falco has no login, no web interface and no user database, so no bootstrap credential exists in the image. Its only HTTP surface is a health and version endpoint, which this image binds to the loopback interface so it is not reachable from your virtual network at all. The only open port is SSH, using your own key. Alerts are written as JSON to a root only log, unbuffered, so a log shipper can consume them with no parsing configuration.

Falco is Apache-2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the Falco project, the CNCF or Sysdig; this image is the open source Falco engine and contains no proprietary component. The cloudimg charge covers packaging, hardening, security patching and 24/7 support with a 24 hour response SLA.