docker/README.md
This directory contains various ways to package Falco as a container and related tools.
| Name | Directory | Description |
|---|---|---|
| falcosecurity/falco:latest, falcosecurity/falco:tag, falcosecurity/falco:master | docker/falco | Distroless image based on the latest released tar.gz of Falco. No tools are included in the image. |
| falcosecurity/falco:latest-debian, falcosecurity/falco:tag-debian, falcosecurity/falco:master-debian | docker/falco-debian | Debian-based image. Include some tools (i.e. jq, curl). No driver-building toolchain support. |
| falcosecurity/falco-driver-loader:latest, falcosecurity/falco-driver-loader:tag, falcosecurity/falco-driver-loader:master | docker/driver-loader | Based on falcosecurity/falco:x.y.z-debian (see above) plus the driver building toolchain support and falcoctl. This is intended to be used as an installer or an init container when modern eBPF cannot be used. |
| falcosecurity/falco-driver-loader:latest-buster, falcosecurity/falco-driver-loader:tag-buster, falcosecurity/falco-driver-loader:master-debian | docker/driver-loader-buster | Similar to falcosecurity/falco-driver-loader (see above) but based on a legacy Debian image (i.e. buster ). Recommended only for old kernel versions. |