This repository aims to document the evolution process of The Falco Project.
It provides a space for the community to work together, discuss ideas, and document processes. It is also a place to make decisions that regard the whole falcosecurity organization and define rules and structures that span beyond the extent of a single repository.
Table of Contents
The Falco Project governance model is documented in the GOVERNANCE.md file.
We follow the CNCF Code of Conduct.
Please contact cncf-falco-maintainers@lists.cncf.io or the Linux Foundation mediator, Mishi Choudhary mishi@linux.com to report an issue.
The process to become a maintainer is documented in the MAINTAINERS_GUIDELINES.md file.
You can find the list of current maintainers in the MAINTAINERS.md file.
The Falco Project follows a simple adoption model for repositories. Each repository gets a status that indicates the level of adoption (ie. the maturity level) or, for particular repositories, its scope. The criteria for adoption or changing the status will remain loose and tightened as needed at the discretion of the community.
You can find more details in the REPOSITORIES.md file.
In the sections below, we list the repositories grouped by status.
Core repositories can ultimately achieve the highest and most coveted status within The Falco Project: "Official."
You can request the promotion of a repository by submitting an issue.
List of repositories in Official status (core repositories)
| NAME | DESCRIPTION |
|---|---|
| falcosecurity/charts | Helm charts for running Falco with Kubernetes |
| falcosecurity/deploy-kubernetes | Kubernetes deployment resources for Falco |
| falcosecurity/falco | Cloud Native Runtime Security |
| falcosecurity/falco-website | Hugo content to generate website content. Hosted by the CNCF |
| falcosecurity/libs | libsinsp, libscap, the kernel module driver, and the eBPF driver sources |
| falcosecurity/plugin-sdk-go | |
| falcosecurity/plugins | Falco plugins registry |
The "Incubating" level refers to those repositories that contain non-core components or any subprojects that don't yet have an adequate level of maturity. You can request the incubation of a repository by submitting an issue.
List of repositories in Incubating status
| NAME | DESCRIPTION |
|---|---|
| falcosecurity/client-go | Go client and SDK for Falco |
| falcosecurity/driverkit | Kit for building Falco drivers: kernel modules or eBPF probes |
| falcosecurity/event-generator | Generate a variety of suspect actions that are detected by Falco rulesets |
| falcosecurity/falco-exporter | Prometheus Metrics Exporter for Falco output events |
| falcosecurity/falco-aws-terraform | Terraform Module for Falco AWS Resources |
| falcosecurity/falcoctl | Administrative tooling for Falco |
| falcosecurity/falcosidekick | Connect Falco to your ecosystem |
| falcosecurity/falcosidekick-ui | A simple WebUI with latest events from Falco |
| falcosecurity/kernel-crawler | A tool to crawl Linux kernel versions |
| falcosecurity/kilt | Kilt is a project that defines how to inject foreign apps into containers |
| falcosecurity/libs-sdk-go | Go SDK for Falco libs |
| falcosecurity/plugin-sdk-cpp | Falco plugins SDK for C++ |
| falcosecurity/test-infra | Falco workflow & testing infrastructure |
| falcosecurity/syscalls-bumper | A tool to automatically update supported syscalls in libs |
You can find "Sandbox" level ideas/projects/code under the falcosecurity/contrib repository.
Some repositories have a special meaning and do not fit the above statuses. They serve a particular purpose or function in the falcosecurity organization and are curated by core maintainers.
List of Special repositories
| NAME | DESCRIPTION |
|---|---|
| falcosecurity/.github | Default community health files |
| falcosecurity/community | The Falco Project Community |
| falcosecurity/evolution | Evolution process of The Falco Project |
In general, a repository can be archived at the discretion of The Falco Project community. Usually, maintainers can decide to archive a project that has not been maintained for a long time or does not fit the guidelines for the projects under the falcosecurity GitHub's organization anymore. In other cases, a repository is archived to reserve its name for future use.
The list of archived repositories can be found here.
Finally, repositories that are no longer maintained or relevant to The Falco Project will be retired definitively. Periodically, the maintainers clean up the falcosecurity and move these projects to the Falco Projects Retirement Home GitHub's organization.
See the contributing guide and the code of conduct.
To report a security vulnerability, please follow our security policy.
To get involved with The Falco Project, please visit the community repository to find more.