Practical Cloud Native Security with Falco

Chapter 14. Falco Development

Extending Falco is the best way to ensure that it perfectly fits your unique requirements. This chapter will show you three approaches to Falco development. We’ll begin with an overview of Falco’s codebase and a quick guide to building Falco from the source, which allows you to work with Falco’s code directly. This first approach gives you more freedom but is more difficult and perhaps less convenient than the other two. The second approach lets you build an application that processes Falco notifications in the desired way by interfacing with the gRPC API. The third is the standard and easiest way of extending Falco: writing your own plugin.

For the last two approaches, we will teach you by using examples. We use the Go programming language in these code snippets, so some familiarity with it will be helpful, but it’s not strictly required. This chapter also assumes that you have read Part II of this book. If you are concerned that this material may be too difficult, don’t be scared: we think you’ll find it understandable and interesting even if you are not a developer.

Programming Languages for Falco Development

Falco’s core is written mainly in C++, with some low-level components in C (like libscap and the drivers). To fully understand the codebase or work with the core components, a good knowledge of C/C++ is required. However, Falco also exposes the gRPC and Plugin APIs, which you can use to develop components for Falco in virtually any programming ...