In the Eye of Falco: Transforming Your View of Linux Kernel Security
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 15:00· Platinum Suite | Level 3 | Room 1-2·
summary
Falco moves to a smaller default Wolfie minimal image to cut build-time CVE noise, ships low‑level optimizations (clang/zig and allocator changes) that yield about 10% throughput on event processing, and replaces brittle C++ container lookups with a multi‑language container metadata plugin that provides near‑instant enrichment for short‑lived containers. Falco Talon adds Kubernetes‑native response actions (now including GCP), there’s a Falco Actions GitHub integration, AKS and vcloud MKS audit plugins, a Falco operator for artifact lifecycle, and a declarative event generator test suite.
AI-written summary · about
chapters (9)
- 0:00Falco introduction
- 1:51Agenda and latest features
- 3:36Streamlined container images
- 6:05Ecosystem projects
- 8:33Kubernetes audit log plugins
- 15:12Container metadata updates
- 21:11Falco Kubernetes operator
- 26:56Event generator improvements
- 29:28Community and closing
related talks
28mSecurity In the Cloud With Falco: Overview And Project Updates
38mDeep Dive: Falco
38mIntro: Falco
23mRuntime K8s Security: Threat Detection with Falcosidekick
38mIntro: Falco
54mResponding to security events on Kubernetes, let's build a Security..
01h 33mCloud Native Runtime Security with Falco
36mIntro: Falco