falco rules validation through docker

[jaguasch]

I am trying to create a build step on my CI to validate falco rules using docker run (map volume for rules) sysdig/falco falco --validate <path_to_falco_rules_on_container>

The issue is that docker will fail on exit because tries to run falco itself.

Any way to run falco in a container just to validate rules and rely on exit code to check if rules are ok or not?

[mfdii]

This worked for me:

vagrant@vagrant:~$ docker run -e SYSDIG_SKIP_LOAD=1 -it sysdig/falco /usr/bin/falco -V /etc/falco/falco_rules.yaml 
Tue Mar  6 21:01:42 2018: Validating rules file: /etc/falco/falco_rules.yaml...
Tue Mar  6 21:01:43 2018: Ok

There seems to be a bug where --validate isn't recognized.