Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

new(image): add Falco image based on RedHat UBI #1943

Merged
merged 12 commits into from
Mar 23, 2022
Merged

new(image): add Falco image based on RedHat UBI #1943

merged 12 commits into from
Mar 23, 2022

Conversation

araujof
Copy link
Member

@araujof araujof commented Mar 16, 2022

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:

This PR introduces a Falco image based on RedHat's UBI (Universal Base Image). The UBI has a short release cycle with a special focus on security and stability. It has a smaller trusted computing base and a narrower exploit window than most publicly-available docker images. This is particularly helpful in hardened deployments with strict vulnerability scanning policies for agent admission.

Which issue(s) this PR fixes:

NONE

Special notes for your reviewer:

Example automation with a GHA workflow is available in the forked git repository.

Does this PR introduce a user-facing change?:

new(image): add Falco image based on RedHat UBI

LucaGuerra
LucaGuerra reviewed Mar 16, 2022
View reviewed changes
docker/ubi/Dockerfile Outdated Show resolved Hide resolved
LucaGuerra
LucaGuerra reviewed Mar 16, 2022
View reviewed changes
docker/ubi/Dockerfile Outdated Show resolved Hide resolved
@LucaGuerra
Copy link
Contributor

As I mentioned in community call, I really like this! To add on top of what @araujof already mentioned, the image itself is also lighter than the large official one. So this means faster and easier security maintenance and lighter system footprint, sign me up :D !
The only drawback is that there are systems (especially old ones) where you can't use this image to compile the kmod or ebpf probe, in those cases you'll need to use the big one. However, the version of gcc that ships with UBI is compatible with most widely used kernels 👍 .

@poiana poiana requested review from leogr and mstemm March 16, 2022 18:17
@poiana poiana added the size/M label Mar 16, 2022
@araujof
Copy link
Member Author

araujof commented Mar 16, 2022

@LucaGuerra I fixed the package cache cleanup issue and set the default value you suggested for the UBI_VERSION. Thanks for your comments!

terylt and others added 9 commits March 17, 2022 10:44
@terylt @araujof
build(image): updated UBI image to build dkms, and use falco binaries…
9d1762d 
… rather than rpm. This reduces dependencies.

Signed-off-by: TPT <teryl.taylor@gmail.com>
@terylt @araujof
build(image): simplified untarring command to install falco binary an…
60f0b86 
…d scripts in ubi

Signed-off-by: TPT <teryl.taylor@gmail.com>
@araujof
build(image): fixed handling of default falco version
b4a0daa 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
build(image): added label for ubi version and updated description labels
e11a0a0 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(docker/readme): fix grammatically incorrect split of infinitive
974b3af 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refactor(build): moved Dockerfile and entrypoint script for UBI-based…
927e364 
… image to its own directory

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
docs(docker/readme): updated table to include experimental UBI-based …
2c38853 
…image for Falco

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(image): update package cache cleanup command
08b4259 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(image): set default value for UBI_VERSION build arg
a330735 
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@jasondellaluce
Copy link
Contributor

/check-dco

@LucaGuerra
Copy link
Contributor

Happy now Poiana?

leogr
leogr reviewed Mar 18, 2022
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is cool! 🤩

Just left two minor suggestions, otherwise LGTM!

Thank you for this contribution :)

docker/ubi/docker-entrypoint.sh Outdated Show resolved Hide resolved
docker/ubi/docker-entrypoint.sh Outdated Show resolved Hide resolved
docker/ubi/docker-entrypoint.sh Outdated Show resolved Hide resolved
araujof and others added 2 commits March 22, 2022 11:33
@araujof @leogr
refactor(image): remove -x flag in ubi docker entrypoint
811b1bf 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refator(image): commented and moved symlinks inside SKIP_DRIVER_LOADE…
42f3d0e 
…R check

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@leogr
Copy link
Member

leogr commented Mar 23, 2022

/milestone 0.32.0

@poiana poiana added this to the 0.32.0 milestone Mar 23, 2022
leogr
leogr approved these changes Mar 23, 2022
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now!

@araujof
Thank you for having addressed all my concerns 👍
And thank you for this PR :)

docker/ubi/docker-entrypoint.sh Outdated Show resolved Hide resolved
docker/ubi/docker-entrypoint.sh Outdated Show resolved Hide resolved
@poiana poiana added the lgtm label Mar 23, 2022
@poiana
Copy link
Contributor

poiana commented Mar 23, 2022

LGTM label has been added.

Git tree hash: 18e2d52cb0884d078868bf7fa8788e2e011a404c

jasondellaluce
jasondellaluce approved these changes Mar 23, 2022
View reviewed changes
Copy link
Contributor

@jasondellaluce jasondellaluce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

Thank you!!

@poiana
Copy link
Contributor

poiana commented Mar 23, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: araujof, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 26a3b7a into falcosecurity:master Mar 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@terylt terylt terylt left review comments

@LucaGuerra LucaGuerra LucaGuerra left review comments

@leogr leogr leogr approved these changes

@jasondellaluce jasondellaluce jasondellaluce approved these changes

@mstemm mstemm Awaiting requested review from mstemm

Assignees

@leogr leogr

@jasondellaluce jasondellaluce

Labels
approved area/build dco-signoff: yes lgtm release-note size/M
Projects
None yet
Milestone
0.32.0
Development

Successfully merging this pull request may close these issues.
6 participants
@araujof @LucaGuerra @jasondellaluce @leogr @poiana @terylt