Runtime Security with Falco (CKS)
Watch syscalls for behaviour that should never happen, and make containers immutable.
An interactive Kubernetes lesson: 19 steps, about 35 minutes, on a live simulation in your browser.
The shop's frontend, web, has a bug in its image upload. Someone on the internet uses it to run commands inside one web container.
Every control from the earlier lessons did its job. The image was scanned and signed. The pod passed admission. RBAC is tight. None of that is involved now, because nothing new is being created: a process that was allowed to start is doing something it was never meant to do.
What you will learn
Nobody is watching
- An intruder, and no record of it: Admission controls what may start. After that, a running container is judged by nobody unless you add something that watches.
- Falco: a sensor on the kernel: Falco is a camera, not a lock. It reads the kernel's syscall stream and tells you what processes actually did.
Behaviour that raises an alert
- A shell in a container: Runtime detection is a list of things your workloads never do. When one of them happens, that is the signal.
- Reading a file nobody should read
- Break it: install tools, plant a job: Detection tells you it happened. Whether it could happen is decided by how the container was configured to run.
- Reading an alert
Rules: reading and writing them
- Anatomy of a rule: A rule is a sentence about one syscall: when this condition holds, print this output at this priority.
- Write a rule of your own
- Change a shipped rule: Never edit the shipped rules file. The local file is loaded later, so what you write there wins.
- Drill: find Falco's alerts
One sensor, every workload
- One sensor sees every workload: The kernel is the one place every container's activity passes through. Watch there and no workload is out of view.
Immutable at runtime
- Break it: a read-only root filesystem
- Writable only where it must be: Immutable means the image is the whole truth: read-only root, a scratch volume for the few paths that must change, no way to become root.
- Replay the attack: Immutability makes the attack fail. Falco tells you it was attempted. You want the failure and the report.
Responding
- Isolate the pod, keep the evidence: Isolate first, investigate second, delete last. A deleted pod takes its evidence with it.
- Bigger hammers: cordon, scale to zero
- Drill: stop the workload
Recap & playground
- Cheat sheet
- Playground