falco
falco copied to clipboard
Support multiple container runtime in one node
Motivation The bottlerocket OS has two containerd runtime with different sock file, one for k8s, one for host-containers(management), currently only the k8s containerd is monitored, but we need falco to monitor another containerd.
And also in some scenarios, like Docker in Docker, the CI pod would host another docker daemon for build purpose.
Feature Support multiple container runtime in one node.
Alternatives None.
Additional context
Bottlerocket uses host containers(exclude from the k8s containerd, called host-containerd) to run ssh server (admin-container) and aws ssm. And these host containers should be monitored because of all the privileges that host containers have can access the k8s pods.