The Docker hardening guide covered earlier addresses how containers are configured — capabilities, user permissions, network isolation — but doesn’t address monitoring what a container actually does once it’s genuinely running. Falco fills exactly that gap, watching container behavior in real time and alerting on suspicious activity that configuration hardening alone can’t catch after the fact.

What Is Falco?

Falco is a free, open-source runtime security tool, originally created by Sysdig and now a CNCF project, that monitors system calls and container behavior in real time, comparing observed activity against a customizable rule set designed to flag truly suspicious patterns — a shell spawned inside a container that shouldn’t normally have one, an unexpected outbound connection, or a sensitive file being read unexpectedly.

Why Runtime Monitoring Matters Beyond Configuration Hardening

The Docker hardening guide’s practices (non-root users, dropped capabilities, read-only filesystems) reduce what a compromised container can do, but don’t provide visibility into whether a container has actually been compromised in the first place. Falco addresses this specifically — even a well-hardened container benefits from runtime monitoring that can detect and alert on really anomalous behavior as it happens, rather than relying purely on preventive configuration.

Installing Falco

For a Docker-based homelab, Falco typically runs as a privileged container itself, given the deep system-level access required to observe other containers’ behavior:

docker run --rm -i -t \
  --privileged \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /dev:/host/dev \
  -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro \
  -v /lib/modules:/host/lib/modules:ro \
  -v /usr:/host/usr:ro \
  falcosecurity/falco:latest

For persistent deployment, this is better configured as a proper systemd service or Docker Compose entry running continuously rather than the interactive example above.

Understanding Falco’s Default Rules

Falco ships with an extensive default rule set covering common suspicious patterns:

• Terminal shell spawned in a container – flags interactive shell access inside a container that shouldn’t normally have one, a common indicator of an attacker who’s gained container access
• Sensitive file reads – monitors access attempts to files like /etc/shadow from within containers that shouldn’t need that access
• Unexpected outbound network connections – flags containers making connections to addresses outside expected patterns
• Container escape indicators – monitors for specific system call patterns associated with known container escape techniques

Reviewing Falco Alerts

By default, Falco outputs alerts to standard output/logs, viewable directly:

docker logs falco

For more structured, searchable alert review, Falco supports output plugins that can forward alerts to external systems — including forwarding into the centralized logging setup (Grafana Loki, ) or the broader SIEM capabilities (Wazuh, also covered earlier) for unified visibility alongside your other security monitoring.

Writing Custom Rules

Beyond the default rule set, Falco supports custom rules tailored to your specific homelab’s expected behavior — for example, flagging any unexpected process execution inside your Vaultwarden container (), given how sensitive that specific service’s data is:

yaml

- rule: Unexpected process in Vaultwarden container
  desc: Alert on any process execution inside the Vaultwarden container
  condition: container.name = "vaultwarden" and spawned_process
  output: "Unexpected process in Vaultwarden container (command=%proc.cmdline)"
  priority: WARNING

Reducing False Positives

Similar to the Suricata tuning , Falco’s default rule set can generate alerts for legitimate application behavior specific to your actual setup. Review initial alerts carefully, adding specific exceptions for confirmed-legitimate patterns rather than broadly disabling entire rule categories, which risks missing actually suspicious activity alongside the false positives.

Falco vs Wazuh: Complementary, Not Redundant

Wazuh () provides broader host-level and log-based security monitoring across your entire homelab, while Falco specifically focuses on deep, container-runtime-level behavioral monitoring — the two particularly complement each other, with Falco catching container-specific runtime anomalies that Wazuh’s broader log-based approach wouldn’t necessarily surface with the same depth or immediacy.

Resource Considerations

Falco’s deep system-level monitoring carries real resource overhead, though generally modest for typical homelab container counts. Monitor Falco’s own resource consumption (via Netdata, ) alongside everything else, confirming it doesn’t significantly impact the performance of the containers it’s actually monitoring.

Final Thoughts

Setting up Falco for container runtime security adds real behavioral monitoring on top of the preventive configuration hardening covered in the earlier Docker security guide, catching suspicious activity as it actually happens rather than only reducing what a compromised container is capable of doing. For a homelab running as many containerized services as this series has covered, runtime monitoring specifically for container behavior closes a real visibility gap that configuration hardening alone leaves open.

Related Posts

• How to Use Nmap for Network Security Scanning
• How to Set Up Two-Factor Authentication for SSH on Linux
• How to Set Up a Firewall on Linux with UFW