/falco2seccomp

Convert Falco logs to Docker seccomp profiles

Primary LanguageGo

falco2seccomp

This tool is designed to convert Falco JSON logs to Docker seccomp profiles

The Falco rule which this tool is designed to work with looks like:

- rule: container_syscall
  desc: Capture syscalls for any docker container
  priority: WARNING
  condition: container.id != host and syscall.type exists
  output: "%container.id:%syscall.type"

This tool was first introduced in Using-Falco-to-secure-Docker-containers