Project: Falco (Provisioning / Security & Compliance)
File: 20200506-artifacts-scope-part-1.md

The Falco Artifact Scope proposal is divided in two parts: the Part 1 - this document: the State of Art of Falco artifacts the : the intended state moving forward As a project we would like to support the following artifacts. Everything else will be moved to . As a project we will build, change, rename, and move files, documents, scripts, configurations according to the new state of the art described into . Inspired by many previous issues and many of the weekly community calls. falco The Falco binary driver System call provider from the Linux kernel. Either (`bpf`, `module`) falco-driver-loader The bash script found that tries to compile else download the driver (kernel module or eBPF probe). package An installable artifact that is operating system specific. All packages MUST be hosted on . image OCI compliant container image hosted on dockerhub with tags for every release and the current master branch. List of currently official packages (for x86 64bits only): `falco-x.y.z-x86_64.deb` for debian like systems, it installs the kernel module by default `falco-x.y.z-x86_64.rpm` for rpm like systems, it installs the kernel module by default `falco-x.y.z-x86_64.tar.gz` for binary installation, it contains `falco` binary, `falco-driver-loader` script, drivers source, and related dependencies List of currently official container images (for X86 64bits only): | Name | Directory | Description | |||| | , , | docker/stable | Falco (DEB built from git tag or from the master) with all the building toolchain. | | , , | docker/slim | Falco (DEB build from git tag or from the master) without the building toolchain. | | , , | docker/driver-loader | `falco-driver-loader` as entrypoint with the building toolchain. | | | docker/builder | The complete build tool chain for compiling Falco from source. See for more details on building from source. Used to build Falco (CI). | | | docker/tester | Container image for running the Falco test suite. Used to run Falco integration tests

| | to not be published | docker/local | Built on-the-fly and used by falco-tester. | Note: `falco-builder`, `falco-tester` (and the `docker/local` image which it's built on the fly by the `falco-tester` one) are not integrated into the release process because they are development and CI tools that need to be manually pushed only when updated. We will modeling a loosely defined adoption of the Kubernetes and CNCF incubator efforts. The criteria will remain loose, and tighten as needed at the discretion of the Falco open source community. "Sandbox level" This new repository will be equivalent to the `Falco Sandbox` and serves as a place for the community to `test-drive` ideas/projects/code. "Incubating level" projects such as can be promoted from `contrib` to their own repository. This is done as needed, and can best be measured by the need to cut a release and use the GitHub release features. Again, this is at the discretion of the Falco open source community. As the need for a project grows, it can ultimately achieve the highest and most coveted status within The Falco Project. "Official support." The artifacts listed above are part of the official Falco release process. These artifact will be refined and amended by the . The Part 1 is mainly intended as a cleanup process. For each item not listed above, ask if it needs to be moved or deleted. After the cleanup process, all items will match the Part 1 of this proposal. Here are SOME of the items that would need to be done, for example: Remove `minimal` from `falco` repository (it's almost similar to `slim`, we don't need two images for the same purpose) Rename `driverloader` image to `falco-driver-loader` (since it has not been release yet, we can rename it without breaking things) Move everything else to contrib Move to contrib Move to contrib Old documentation Update documentation in . YAML manifest documentation to be moved to `contrib` Minikube, Kind, Puppet, Ansible, etc documentation to be moved to `contrib`