Falco – Developer Guide

Docs: Build Falco from source

Mon, 01 Jan 0001 00:00:00 +0000

Welcome to the guide on how to build Falco yourself! You are very brave! Since you are already doing all this, chances that you are willing to contribute are high! Please read our contributing guide.

Install the dependencies

CentOS 8 Stream / RHEL 8

dnf install git gcc gcc-c++ make cmake elfutils-libelf-devel perl-IPC-Cmd

apt update && apt install git cmake clang build-essential linux-tools-common linux-tools-generic libelf-dev bpftool

pacman -S git cmake make gcc wget
pacman -S zlib jq yaml-cpp openssl curl c-ares protobuf grpc libyaml bpf

You'll also need kernel headers for building and making binaries properly.

pacman -S linux-headers

You can use uname -r to determine the kernel version and select the appropriate header.

Since Alpine ships with musl instead of glibc, to build on Alpine, we need to pass the -DMUSL_OPTIMIZED_BUILD=On CMake option.

If that option is used along with the -DUSE_BUNDLED_DEPS=On option, then the final build will be 100% statically-linked and portable across different Linux distributions.

apk add g++ gcc cmake make git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static binutils bpftool clang

zypper -n install git gcc12 gcc12-c++ cmake make libelf-devel gawk

Build Falco

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake -DUSE_BUNDLED_DEPS=ON ..
make falco

More details here.

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake -DUSE_BUNDLED_DEPS=On ..
make falco

More details here.

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake ..
make falco

More details here.

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake -DUSE_BUNDLED_DEPS=On -DMUSL_OPTIMIZED_BUILD=On ..
make falco

First, make sure that gcc and g++ are version 9 or above. If you have multiple versions installed you can set the preferred one.

git clone https://github.com/falcosecurity/falco.git
cd falco
mkdir -p build
cd build
cmake -DUSE_BUNDLED_DEPS=ON ..
make falco

More details here.

Build kernel module driver

In the build directory:

yum -y install kernel-devel-$(uname -r)
make driver

More details here.

Kernel headers are required to build the driver.

apt install linux-headers-$(uname -r)

In the build directory:

make driver

In the build directory:

pacman -S --needed linux-headers
make driver

More details here.

NO STEP

In the build directory:

zypper -n install kernel-default-devel
make driver

Build eBPF driver (deprecated)

If you do not want to use the kernel module driver you can, alternatively, build the eBPF driver as follows.

In the build directory:

dnf install clang llvm
cmake -DBUILD_BPF=ON ..
make bpf

If you do not want to use the kernel module driver you can, alternatively, build the eBPF driver as follows.

In the build directory:

apt install llvm clang
cmake -DBUILD_BPF=ON ..
make bpf

If you do not want to use the kernel module driver you can, alternatively, build the eBPF driver as follows.

In the build directory:

pacman -S llvm clang
cmake -DBUILD_BPF=ON ..
make bpf

NO STEP

If you do not want to use the kernel module driver you can, alternatively, build the eBPF driver as follows.

In the build directory:

zypper -n install clang llvm
cmake -DBUILD_BPF=ON ..
make bpf

Dependencies

By default Falco build bundles most of its runtime dependencies dynamically.

You can notice this observing that the option USE_BUNDLED_DEPS is OFF by default. Which means that, whether applicable, Falco build will try to link against libraries already existing into your machine.

Changing such option to ON causes Falco build to bundle all the dependencies statically.

Build Falco

To build Falco, you will need to create a build directory. It's common to have the build directory in the Falco working copy itself, however it can be anywhere in your filesystem.

There are three main steps to compile Falco.

Create the build directory and enter in it
Use cmake in the build directory to create the build files for Falco. .. was used because the source directory is a parent of the current directory, you can also use the absolute path for the Falco source code instead
Build using make