CertGrid CertGrid
Hands-on Lab·Certified Kubernetes Security Specialist

Falco Runtime Detection and Resource Limits

A syscall-level detector is the only thing that sees what happens INSIDE a container. This guide installs one, proves the kernel side works, and then reports honestly what it did on hardware this size.

Monitoring and Runtime Guide 35 of 40 Advanced

Falco 0.41.3 with the modern eBPF engine on a 7.0 kernel with BTF. No alert output appears on this page, because none was produced.

cka7001: one control plane and one worker. The DaemonSet was pinned to the worker.
Server NameIP AddressOSRolesCPURAMHDD
CKA7001192.168.0.51Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA7001-NODE01192.168.0.52Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when something has to see inside a container at runtime. This matters because a syscall detector is the only thing that can - and on a small node it asks for more than the node has, which is a decision rather than a failure.

Before you start

  1. What a syscall detector needs from the kernel

  2. What it asks for in return

  3. What actually happened on a node this size

  4. The part you are actually asked to write

  5. Putting it back, and what to do instead

Official sources

← All CKS guides