{"id":44288628,"url":"https://github.com/tupacalypse187/falco-airgapped-deployment","last_synced_at":"2026-02-10T23:08:33.543Z","repository":{"id":328549182,"uuid":"1115154491","full_name":"tupacalypse187/falco-airgapped-deployment","owner":"tupacalypse187","description":"Complete solution for deploying Falco security in air-gapped environments with local testing and AWS EKS production deployment","archived":false,"fork":false,"pushed_at":"2025-12-20T16:39:00.000Z","size":99,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-22T18:40:03.342Z","etag":null,"topics":["air-gapped","almalinux","container-security","devops","eks","falco","helm","kubernetes","runtime-security","security"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tupacalypse187.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-12T12:23:09.000Z","updated_at":"2025-12-20T16:39:03.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/tupacalypse187/falco-airgapped-deployment","commit_stats":null,"previous_names":["tupacalypse187/falco-airgapped-deployment"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/tupacalypse187/falco-airgapped-deployment","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tupacalypse187%2Ffalco-airgapped-deployment","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tupacalypse187%2Ffalco-airgapped-deployment/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tupacalypse187%2Ffalco-airgapped-deployment/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tupacalypse187%2Ffalco-airgapped-deployment/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tupacalypse187","download_url":"https://codeload.github.com/tupacalypse187/falco-airgapped-deployment/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tupacalypse187%2Ffalco-airgapped-deployment/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29321277,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-10T20:44:44.282Z","status":"ssl_error","status_checked_at":"2026-02-10T20:44:43.393Z","response_time":65,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["air-gapped","almalinux","container-security","devops","eks","falco","helm","kubernetes","runtime-security","security"],"created_at":"2026-02-10T23:08:33.435Z","updated_at":"2026-02-10T23:08:33.535Z","avatar_url":"https://github.com/tupacalypse187.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Falco Air-Gapped Deployment Project\n\nThis project provides a complete solution for deploying Falco, the cloud-native runtime security tool, in air-gapped environments where there is no access to the internet. It includes local testing setups for Windows 11 and macOS, and a production-ready deployment for AWS EKS.\n\n## Project Goals\n\n- **Air-Gapped Deployment**: Deploy Falco in an environment with no internet connectivity.\n- **Private Registries**: Use a private ECR registry for all container images.\n- **Custom Base Images**: Build all container images on `almalinux:9`.\n- **Plugin Management**: Handle Falco plugins (`container` and `audit-eks`) without pulling from public registries like `ghcr.io`.\n- **Flexible Plugin Installation**: Provide two methods for plugin installation:\n  1. **Sidecar Container**: An init container that provides the plugins to the Falco container.\n  2. **S3 Bucket**: Falco container pulls plugins from a private S3 bucket on startup.\n- **Local Testing**: A complete local testing environment using Docker Desktop and Minikube.\n- **Production Deployment**: A production-ready deployment on AWS EKS using a Jenkins pipeline.\n- **Comprehensive Documentation**: Detailed README files for both local and production setups.\n\n## Directory Structure\n\n```\n/falco-airgapped-deployment\n├── docker/                      # Dockerfiles for custom images\n│   ├── base/                    # Falco base image (AlmaLinux 9)\n│   └── plugin-loader/           # Plugin loader sidecar image\n├── helm/                        # Helm chart for Falco deployment\n│   └── falco-airgapped/\n├── jenkins/                     # Jenkins pipeline and agent configuration\n├── plugins/                     # Falco plugin artifacts\n│   ├── extracted/               # Extracted .so plugin files\n│   └── source/                  # Source files for plugins (if built from source)\n├── scripts/                     # Build and deployment scripts\n│   ├── local/                   # Scripts for local testing\n│   └── aws/                     # Scripts for AWS deployment\n└── docs/                        # Detailed documentation\n    ├── README_LOCAL.md          # Guide for local setup and testing\n    └── README_PROD.md           # Guide for production deployment on AWS\n```\n\n## Getting Started\n\nThere are two main ways to use this project:\n\n1.  **Local Testing**: If you want to test the Falco deployment on your local machine (Windows 11 or macOS), please refer to the [Local Setup and Testing Guide](docs/README_LOCAL.md).\n\n2.  **Production Deployment**: If you want to deploy Falco to a production environment on AWS EKS, please refer to the [Production Deployment Guide](docs/README_PROD.md).\n\n## How It Works\n\nThis project addresses the challenges of deploying Falco in an air-gapped environment by:\n\n1.  **Extracting Plugin Artifacts**: Instead of building plugins from source (which requires a specific version of `cmake` and other dependencies), we pull the official Falco plugin containers from `ghcr.io` in an environment with internet access and extract the compiled `.so` files. These artifacts are then stored in a private Git repository or an S3 bucket.\n\n2.  **Building Custom Images**: We build custom Falco container images on `almalinux:9`. These images are configured to use the extracted plugin artifacts from either a sidecar container or an S3 bucket, rather than trying to download them from the internet.\n\n3.  **Using a Private Registry**: All container images are pushed to a private ECR registry. The Helm chart is configured to pull images from this private registry.\n\n4.  **Flexible Helm Chart**: The provided Helm chart is designed to be flexible and supports both the `sidecar` and `s3` plugin loading strategies. You can switch between these strategies by changing a single value in the `values.yaml` file.\n\n5.  **Automated Jenkins Pipeline**: A `Jenkinsfile` is provided to automate the entire build and deployment process, from extracting plugins and building images to deploying Falco on an EKS cluster.\n\n## Prerequisites\n\n- **For Local Testing**:\n  - Docker Desktop\n  - Minikube\n  - `kubectl`\n  - `helm`\n\n- **For Production Deployment**:\n  - An AWS account\n  - An EKS cluster\n  - An ECR registry\n  - An S3 bucket (if using the S3 plugin strategy)\n  - A Jenkins server with the necessary plugins and a configured agent.\n\nFor detailed instructions, please refer to the respective README files in the `docs` directory.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftupacalypse187%2Ffalco-airgapped-deployment","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftupacalypse187%2Ffalco-airgapped-deployment","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftupacalypse187%2Ffalco-airgapped-deployment/lists"}