networks:
  default:
  # Falco's own default bridge network, plus netdata's network so netdata
  # can scrape http://falco:8765/metrics by container name.
  netdata_default:
    external: true

services:
  falco:
    image: falcosecurity/falco:0.44.1
    container_name: falco
    restart: always
    cap_drop:
      - all
    cap_add:
      - sys_admin
      - sys_resource
      - sys_ptrace
    security_opt:
      - apparmor:unconfined
    networks:
      - default
      - netdata_default
    ports:
      - "127.0.0.1:8765:8765"
    volumes:
      - /sys/kernel/tracing:/sys/kernel/tracing:ro
      - /var/run/docker.sock:/host/var/run/docker.sock:ro
      - /proc:/host/proc:ro
      - /etc:/host/etc:ro
      - ./config/falco.yaml:/etc/falco/config.d/telemetry.yaml:ro
      - ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
      - ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
      - ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
      - ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
      - ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro
      - ./rules/ssh-persistence.yaml:/etc/falco/rules.d/ssh-persistence.yaml:ro
      - ./rules/cloud-metadata-probe.yaml:/etc/falco/rules.d/cloud-metadata-probe.yaml:ro
      - ./rules/db-spawned-process.yaml:/etc/falco/rules.d/db-spawned-process.yaml:ro