CKS — Falco Setup & Installation

7 minute read

Falco Setup & Installation

Falco is a CNCF graduated project purpose-built for runtime threat detection in Linux and Kubernetes environments. It is the primary runtime security tool tested on the CKS exam. You must be able to install it, configure it, and verify it is capturing events — all under time pressure.

What Is Falco?

Falco monitors system calls (syscalls) made by every process on a host. A kernel module or eBPF probe sits between applications and the kernel, capturing every open, read, write, execve, connect, and hundreds of other syscalls. These events flow into a user-space rules engine that evaluates them against a configurable rule set. When a rule matches, Falco fires an alert.

Key point for the CKS exam: Falco does not block or prevent anything. It is a detection tool. It tells you something bad happened. Combining Falco with admission controllers and network policies gives you prevention + detection.

Falco Architecture

┌───────────────────────────────────────────────────────────────┐
│  Container / Pod                                               │
│  Process calls: open("/etc/shadow", O_RDONLY)                  │
└───────────────┬───────────────────────────────────────────────┘
                │  syscall
┌───────────────▼───────────────────────────────────────────────┐
│  Falco Driver (Kernel Module or eBPF Probe)                    │
│  Captures raw syscall events and streams them to user space    │
└───────────────┬───────────────────────────────────────────────┘
                │  event stream
┌───────────────▼───────────────────────────────────────────────┐
│  Falco Engine (User Space)                                     │
│  ┌─────────────────────────────────────────────────────────┐  │
│  │  Rules:  /etc/falco/falco_rules.yaml                     │  │
│  │          /etc/falco/falco_rules.local.yaml               │  │
│  │  Config: /etc/falco/falco.yaml                           │  │
│  └─────────────────────────────────────────────────────────┘  │
│  Condition matched? → Generate alert                           │
└───────────────┬───────────────────────────────────────────────┘
                │  alert
┌───────────────▼───────────────────────────────────────────────┐
│  Output Channels                                               │
│  stdout | syslog | file | gRPC | HTTP (Falcosidekick)          │
└───────────────────────────────────────────────────────────────┘

Installing Falco (DEB Package — Exam Method)

On the CKS exam, you will most likely install Falco on an Ubuntu/Debian node. The DEB package method is the most exam-relevant.

Step 1 — Add the Falco GPG key and repository:

# Import the GPG key
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | \
  sudo tee /etc/apt/sources.list.d/falcosecurity.list

Step 2 — Install Falco:

sudo apt-get update
sudo apt-get install -y falco

During installation, you may be prompted to select a driver. Choose kmod (kernel module) for simplicity on exam nodes, or ebpf if the exam environment requires it.

Step 3 — Start and enable Falco:

sudo systemctl start falco
sudo systemctl enable falco

Step 4 — Verify Falco is running:

sudo systemctl status falco

Expected output:

● falco.service - Falco: Container Native Runtime Security
     Loaded: loaded (/usr/lib/systemd/system/falco.service; enabled)
     Active: active (running) since ...

Installing Falco via Helm (Reference)

For production clusters, Falco is often deployed as a DaemonSet via Helm:

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

helm install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set falcosidekick.enabled=true

This deploys Falco on every node. The exam typically uses the package-based install, but know this method exists.

Falco Configuration — /etc/falco/falco.yaml

This is the main configuration file. Key settings:

# Which rule files to load (order matters — later files override earlier ones)
rules_file:
  - /etc/falco/falco_rules.yaml          # Default rules (do NOT edit)
  - /etc/falco/falco_rules.local.yaml    # Your custom rules and overrides

# JSON output (useful for log parsers)
json_output: true

# Log level for Falco's own logs
log_level: info

# Outputs configuration
stdout_output:
  enabled: true

syslog_output:
  enabled: true

file_output:
  enabled: false
  filename: /opt/falco/events.txt

http_output:
  enabled: false
  url: http://falcosidekick:2801

Exam tip: If the question asks you to output Falco alerts to a specific file, set file_output.enabled: true and update file_output.filename.

Viewing Falco Logs

# View Falco service logs (most common on the exam)
journalctl -u falco

# Follow logs in real time
journalctl -u falco -f

# Filter by time
journalctl -u falco --since "5 minutes ago"

# If file_output is enabled
tail -f /opt/falco/events.txt

Example Falco alert in logs:

2025-02-09T19:01:00.000000000+0530: Warning A shell was spawned in a container
  with an attached terminal (user=root user_loginuid=-1 container_id=a1b2c3d4
  container_name=nginx image=nginx:latest)
  k8s.ns.name=default k8s.pod.name=web-pod

Testing Falco Detection

After installation, verify Falco detects events:

# Create a test pod
kubectl run test-nginx --image=nginx

# Exec into the pod (this triggers the "Terminal shell in container" rule)
kubectl exec -it test-nginx -- /bin/bash

# Inside the container, read a sensitive file
cat /etc/shadow

# Exit the container
exit

# Check Falco logs for alerts
journalctl -u falco --since "2 minutes ago" | grep -i "shell"

You should see an alert like:

Warning A shell was spawned in a container with an attached terminal
  (user=root container_id=... container_name=test-nginx image=nginx:latest)

Falco Driver Comparison

Falco needs a driver to capture syscalls from the kernel. Two options:

Feature Kernel Module (kmod) eBPF Probe
How it works Loadable kernel module eBPF program loaded into kernel
Performance Slightly faster Slightly slower but improving
Safety Can crash the kernel if buggy Verified by kernel — cannot crash
Compatibility Requires matching kernel headers Requires kernel ≥ 4.14 with eBPF
Exam default Usually the default May be required in some environments
Installation falco-driver-loader module falco-driver-loader bpf
Config Set in falco.yaml or systemd Set FALCO_BPF_PROBE="" env var

Switching drivers:

# Load the kernel module driver
sudo falco-driver-loader module

# Load the eBPF driver
sudo falco-driver-loader bpf

# Restart Falco after switching
sudo systemctl restart falco

Falco as a DaemonSet

When deployed via Helm or a manifest, Falco runs as a DaemonSet — one Pod per node. Each Falco Pod:

  • Mounts /dev, /proc, /boot, /lib/modules from the host
  • Runs in privileged mode (required to load the kernel module)
  • Uses a hostPID: true setting to see all processes on the node
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: falco
spec:
  selector:
    matchLabels:
      app: falco
  template:
    metadata:
      labels:
        app: falco
    spec:
      hostPID: true
      containers:
      - name: falco
        image: falcosecurity/falco:latest
        securityContext:
          privileged: true
        volumeMounts:
        - name: dev
          mountPath: /host/dev
        - name: proc
          mountPath: /host/proc
          readOnly: true
        - name: boot
          mountPath: /host/boot
          readOnly: true
        - name: modules
          mountPath: /host/lib/modules
          readOnly: true
        - name: config
          mountPath: /etc/falco
      volumes:
      - name: dev
        hostPath:
          path: /dev
      - name: proc
        hostPath:
          path: /proc
      - name: boot
        hostPath:
          path: /boot
      - name: modules
        hostPath:
          path: /lib/modules
      - name: config
        configMap:
          name: falco-config

Restarting Falco After Configuration Changes

Any time you modify /etc/falco/falco.yaml or rule files, restart Falco:

sudo systemctl restart falco

# Verify it came back cleanly
sudo systemctl status falco

# Check for rule parsing errors
journalctl -u falco --since "1 minute ago" | head -30

If Falco fails to start, check for YAML syntax errors in your rule files:

# Validate Falco configuration
sudo falco --validate /etc/falco/falco_rules.local.yaml

Key File Locations Summary

Path Purpose
/etc/falco/falco.yaml Main configuration file
/etc/falco/falco_rules.yaml Default rules — never edit
/etc/falco/falco_rules.local.yaml Custom rules and overrides
/usr/bin/falco Falco binary
/usr/lib/systemd/system/falco.service Systemd unit file

Practice Questions

Question 1

You need to install Falco on a CKS exam node running Ubuntu. Which installation method is most likely expected?

Show Answer

DEB package installation — the exam provides Linux nodes where you install Falco via apt-get:

curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main" | \
  sudo tee /etc/apt/sources.list.d/falcosecurity.list

sudo apt-get update && sudo apt-get install -y falco
sudo systemctl start falco

Question 2

After installing Falco, you want to verify it is detecting events. What is the quickest way to generate and confirm an alert?

Show Answer

Exec into any running container and check Falco logs:

kubectl exec -it <pod-name> -- /bin/sh
exit

journalctl -u falco --since "1 minute ago" | grep -i "shell"

The default rule “Terminal shell in container” fires whenever a shell is spawned inside a container with an attached terminal.

Question 3

You need Falco to write alerts to /opt/falco/alerts.txt. Which file do you edit and what settings do you change?

Show Answer

Edit /etc/falco/falco.yaml:

file_output:
  enabled: true
  filename: /opt/falco/alerts.txt

Then restart Falco:

sudo systemctl restart falco

Question 4

What is the difference between Falco’s kernel module driver and the eBPF probe?

Show Answer
Feature Kernel Module eBPF Probe
Mechanism Loadable kernel module eBPF program
Safety Can crash kernel if buggy Verified by kernel verifier — safe
Performance Slightly faster Comparable, improving
Requirements Kernel headers Kernel ≥ 4.14 with eBPF support
Switch command falco-driver-loader module falco-driver-loader bpf

Both capture the same syscall events. The eBPF probe is safer but requires a newer kernel.

Question 5

Falco fails to start after you edited the custom rules file. How do you diagnose the issue?

Show Answer
  1. Check Falco service status:
sudo systemctl status falco
  1. Check journal logs for parsing errors:
journalctl -u falco --since "2 minutes ago"
  1. Validate the rules file directly:
sudo falco --validate /etc/falco/falco_rules.local.yaml

Most failures are YAML syntax errors — incorrect indentation, missing colons, or unquoted strings with special characters.

Next: Falco Rules →

Updated:

You may also enjoy