thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)
Apache License 2.0
16 stars 4 forks source link

Add Google COS builder POC #55

Closed markchalloner closed 1 year ago

markchalloner commented 1 year ago

The PR adds a shell script to build falco probes for Google COS, and updates the POC Dockerfile to use Ubuntu as the build environment as the version of glibc that comes with the falco-driver-loader docker image (believe the OS is Debian Jessie) is too old for some of the Google COS kernel header tooling.

I've deliberately not squashed the two commits as there is some code in the first commit to create a COS-like environment, which ultimately we probably won't use but there is a chance if the probes fail on runtime due to some esoteric difference in the version of clang we use (and that the kernel expects) we may have to revert to. If this is a problem to have in the mainline, suggest that if and when this PR is merged it's done as a squash merge.

markchalloner commented 1 year ago

Still outstanding:

markchalloner commented 1 year ago

@sHesl, can this be merged?