diff --git a/.github/workflows/reusable_build_docker.yaml b/.github/workflows/reusable_build_docker.yaml index f2dab156858..40f6e0c62e3 100644 --- a/.github/workflows/reusable_build_docker.yaml +++ b/.github/workflows/reusable_build_docker.yaml @@ -56,7 +56,17 @@ jobs: --build-arg TARGETARCH=${TARGETARCH} \ . docker save docker.io/falcosecurity/falco-distroless:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/falco-distroless-${{ inputs.arch }}.tar - + + - name: Build no-falcoctl-distroless image + run: | + cd ${{ github.workspace }}/docker/no-driver/ + docker build -f Dockerfile.no-falcoctl-distroless -t docker.io/falcosecurity/no-falcoctl-distroless:${{ inputs.arch }}-${{ inputs.tag }} \ + --build-arg VERSION_BUCKET=bin${{ inputs.bucket_suffix }} \ + --build-arg FALCO_VERSION=${{ inputs.version }} \ + --build-arg TARGETARCH=${TARGETARCH} \ + . + docker save docker.io/falcosecurity/no-falcoctl-distroless:${{ inputs.arch }}-${{ inputs.tag }} --output /tmp/no-falcoctl-distroless-${{ inputs.arch }}.tar + - name: Build falco image run: | cd ${{ github.workspace }}/docker/falco/ diff --git a/docker/no-driver/Dockerfile.no-falcoctl-distroless b/docker/no-driver/Dockerfile.no-falcoctl-distroless new file mode 100644 index 00000000000..7968efe3946 --- /dev/null +++ b/docker/no-driver/Dockerfile.no-falcoctl-distroless @@ -0,0 +1,42 @@ +FROM cgr.dev/chainguard/wolfi-base as builder + +ARG FALCO_VERSION +ARG VERSION_BUCKET=bin + +ENV FALCO_VERSION=${FALCO_VERSION} +ENV VERSION_BUCKET=${VERSION_BUCKET} + +RUN apk update && apk add build-base gcc curl ca-certificates jq elfutils + +WORKDIR / + +RUN FALCO_VERSION_URLENCODED=$(echo -n ${FALCO_VERSION}|jq -sRr @uri) && \ + curl -L -o falco.tar.gz \ + https://download.falco.org/packages/${VERSION_BUCKET}/$(uname -m)/falco-${FALCO_VERSION_URLENCODED}-$(uname -m).tar.gz && \ + tar -xvf falco.tar.gz && \ + rm -f falco.tar.gz && \ + mv falco-${FALCO_VERSION}-$(uname -m) falco && \ + rm -rf /falco/usr/bin/falcoctl && \ + rm -rf /falco/etc/falcoctl && \ + rm -rf /falco/usr/src/falco-* + +RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/etc/falco/falco.yaml > /falco/etc/falco/falco.yaml.new \ + && mv /falco/etc/falco/falco.yaml.new /falco/etc/falco/falco.yaml + +FROM cgr.dev/chainguard/wolfi-base + +LABEL maintainer="cncf-falco-dev@lists.cncf.io" +LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco" + +LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE" +# NOTE: for the "least privileged" use case, please refer to the official documentation + +RUN apk update && apk add libelf libstdc++ + +ENV HOST_ROOT /host +ENV HOME /root + +USER root +COPY --from=builder /falco / + +CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]