{"id":16931087,"url":"https://github.com/issif/docker-plugin","last_synced_at":"2026-03-04T12:31:10.271Z","repository":{"id":43887311,"uuid":"456963647","full_name":"Issif/docker-plugin","owner":"Issif","description":"This is a Falco Plugin allowing to gather events from a locale docker daemon.","archived":false,"fork":false,"pushed_at":"2023-06-15T13:20:56.000Z","size":72,"stargazers_count":5,"open_issues_count":1,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-25T14:21:53.588Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Issif.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-08T14:20:13.000Z","updated_at":"2024-10-17T19:38:42.000Z","dependencies_parsed_at":"2024-06-19T16:23:01.569Z","dependency_job_id":"034ad754-9cfb-487e-91cf-4387aecd193e","html_url":"https://github.com/Issif/docker-plugin","commit_stats":{"total_commits":21,"total_committers":2,"mean_commits":10.5,"dds":0.04761904761904767,"last_synced_commit":"df9d66da1492ff1d18b0f1a1465bb523a0f15ed8"},"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fdocker-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fdocker-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fdocker-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Fdocker-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Issif","download_url":"https://codeload.github.com/Issif/docker-plugin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248458833,"owners_count":21107161,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T20:43:12.105Z","updated_at":"2025-04-11T18:32:47.685Z","avatar_url":"https://github.com/Issif.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Docker Events Plugin\n\nThis repository contains the `docker` plugin for `Falco`, which can fetch events and emit sinsp/scap events (e.g. the events used by `Falco`) for each entry.\n\nThe plugin also exports fields that extract information from a `docker` event, such as the event time, the action, the container name, the container image, the node id (for `swarm` cluster), ...\n\n- [Docker Events Plugin](#docker-events-plugin)\n- [Event Source](#event-source)\n- [Supported Fields](#supported-fields)\n- [Development](#development)\n  - [Requirements](#requirements)\n  - [Build](#build)\n- [Installation](#installation)\n  - [Local](#local)\n  - [With falcoctl](#with-falcoctl)\n- [Settings](#settings)\n- [Configurations](#configurations)\n- [Usage](#usage)\n  - [Requirements](#requirements-1)\n  - [Results](#results)\n\n# Event Source\n\nThe event source for `docker` events is `docker`.\n\n# Supported Fields\n\n| Name                          | Type   | Description                    |\n| ----------------------------- | ------ | ------------------------------ |\n| `docker.status`               | string | Status of the event            |\n| `docker.id`                   | string | ID of the event                |\n| `docker.from`                 | string | From of the event (deprecated) |\n| `docker.type`                 | string | Type of the event              |\n| `docker.action`               | string | Action of the event            |\n| `docker.stack.namespace`      | string | Stack Namespace                |\n| `docker.node.id`              | string | Swarm Node ID                  |\n| `docker.swarm.task`           | string | Swarm Task                     |\n| `docker.swarm.taskid`         | string | Swarm Task ID                  |\n| `docker.swarm.taskname`       | string | Swarm Task Name                |\n| `docker.swarm.servicename`    | string | Swarm Service Name             |\n| `docker.node.statenew`        | string | Node New State                 |\n| `docker.node.stateold`        | string | Node Old State                 |\n| `docker.attributes.container` | string | Attribute Container            |\n| `docker.attributes.image`     | string | Attribute Image                |\n| `docker.attributes.name`      | string | Attribute Name                 |\n| `docker.attributes.type`      | string | Attribute Type                 |\n| `docker.attributes.exitcode`  | string | Attribute Exit Code            |\n| `docker.attributes.signal`    | string | Attribute Signal               |\n| `docker.scope`                | string | Scope                          |                                                           \n\n# Development\n## Requirements\n\nYou need:\n* `Go` \u003e= 1.19\n\n## Build\n\n```shell\nmake build\n```\n\n# Installation\n\n## Local\n\n```shell\nmake install\n```\n \n## With falcoctl\n\nAdd the index:\n```shell\nsudo falcoctl index add docker https://raw.githubusercontent.com/Issif/docker-plugin/workflow/index.yaml\n```\n\nSearch for the artifacts:\n```shell\nsudo falcoctl artifact search docker\n```\n\n```shell\nINDEX   ARTIFACT        TYPE            REGISTRY        REPOSITORY                              \ndocker  docker-rules    rulesfile       ghcr.io         issif/docker-plugin/ruleset/docker-rules\ndocker  docker          plugin          ghcr.io         issif/docker-plugin/plugin/docker \n```\n\nInstall the plugin and the rules:\n```shell\nsudo falcoctl artifact install docker-rules:latest\n```\n\n```shell\n INFO  Reading all configured index files from \"/root/.config/falcoctl/indexes.yaml\"\n INFO  Resolving dependencies ...\n INFO  Installing the following artifacts: [ghcr.io/issif/docker-plugin/ruleset/docker:latest]\n INFO  Preparing to pull \"ghcr.io/issif/docker-plugin/ruleset/docker:latest\"\n INFO  Pulling c09e07b53699: ############################################# 100% \n INFO  Pulling 1be5f42ebc40: ############################################# 100% \n INFO  Pulling 751af53627f8: ############################################# 100% \n INFO  Artifact successfully installed in \"/etc/falco\"  \n```\n\n# Settings\n\nOnly `init` accepts settings:\n* `flushinterval`: time en ms between two flushes of events from `docker` to `Falco` (default: 30ms)\n\n# Configurations\n\n* `falco.yaml`\n\n  ```yaml\n  plugins:\n    - name: docker\n      library_path: /usr/share/falco/plugins/libdocker.so\n      init_config: '{\"flushinterval\": 10}'\n      open_params: ''\n\n  load_plugins: [docker]\n\n  stdout_output:\n    enabled: true\n  ```\n  \u003e :bulb: `init_config` can also set in `yaml` format:\n  \u003e ```yaml\n  \u003e init_config:\n  \u003e   flushinterval: 10\n  \u003e ```\n\n* `rules.yaml`\n\nThe `source` for rules must be `docker`.\n\nSee example:\n```yaml\n- rule: Dummy Rule\n  desc: Dummy Rule\n  condition: docker.status in (start,create,die)\n  output: status=%docker.status from=%docker.from type=%docker.type action=%docker.action name=%docker.attributes.name \n  priority: DEBUG\n  source: docker\n  tags: [docker]\n```\n\n# Usage\n\n```shell\nfalco -c falco.yaml -r docker_rules.yaml\n```\n\n## Requirements\n\n* `Falco` \u003e= 0.34\n\n## Results\n\n```shell\n14:53:29.092313000: Debug status=create from=alpine type=container action=create name=pensive_haibt\n14:53:29.092787000: Debug status=start from=alpine type=container action=start name=pensive_haibt\n14:53:29.092899000: Debug status=die from=alpine type=container action=die name=pensive_haibt\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Fdocker-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fissif%2Fdocker-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Fdocker-plugin/lists"}