Downloading
The Falco Project community only supports two ways for downloading and running Falco:
- Running Falco directly on a Linux host
- Running the Falco userspace program in a container, with a driver installed on the underlying host.
Below you can find artifacts for both.
Download for Linux
| development | stable | |
|---|---|---|
| rpm |  |  |
| deb |  |  |
| binary |  |  |
The list of all available artifacts can be found here.
Download container images
Falco depends on having a driver installed on the host system to get information about the running system calls.
The preferred installation method is to install the driver using the native artifacts defined above or
temporarily run the falcosecurity/falco-driver-loader image as privileged, then using the falcosecurity/falco-no-driver.
For more details, see the Run within Docker section.
| tag | pull command | description |
|---|---|---|
| latest | docker pull falcosecurity/falco-no-driver:latest | The most recent version |
| version | docker pull falcosecurity/falco-no-driver:<version> | A specific version of Falco such as 0.26.2 |
| latest | docker pull falcosecurity/falco-driver-loader:latest | The most recent version of falco-driver-loader with the building toolchain |
| version | docker pull falcosecurity/falco-driver-loader:<version> | A specific version of falco-driver-loader such as 0.26.2 with the building toolchain |
| latest | docker pull falcosecurity/falco:latest | The most recent version with the falco-driver-loader included |
| version | docker pull falcosecurity/falco:<version> | A specific version of Falco such as 0.26.2 with falco-driver-loader included |
The list of all available images can be found here.
Table of contents