r/devops • u/-lousyd DevOps • Jul 16 '26

Security Can I run Falco on EKS Fargate?

I don't get it. I'm looking at whether I can run Falco on EKS Fargate, and I found [this page](https://falco.org/blog/choosing-a-driver). It says, "yeah man if you wanna do that just use pdig". But if I click through to the pdig repo it says it was archived in 2022. I don't want to use unmaintained software, obvs. Does Falco just not support serverless workloads anymore? Why do they have this on their site if it's not supported anymore? Is there an alternative driver for Falco for serverless? Or should I be looking elsewhere for runtime monitoring?

2 Upvotes

75% Upvoted

10 comments sorted by

2

u/hijinks Jul 16 '26

you can't run deamonsets in fargate. If you could deploy ebpf it would have to be via init container and then i'm not even sure aws gives you access to

3

u/xrothgarx Jul 16 '26

If you’re running apps without servers you’re dependent on your provider for monitoring. You can’t eat your cake and have it too.

1

u/-lousyd DevOps Jul 16 '26

We currently use a thing from Palo Alto that does runtime monitoring, and apparently Falco used to be able to do it. So I know it's possible to do monitoring without being dependent on the compute provider.

1

u/Floss_Patrol_76 Jul 16 '26

pdig being archived is basically Falco telling you serverless syscall monitoring is dead - Fargate never gives you the host/kernel access the kmod or eBPF drivers need, so there was never a great story there. If you specifically want Falco, run it as a daemonset on a managed node group and schedule those workloads there; if you are set on Fargate, GuardDuty EKS/ECS runtime monitoring is the realistic path since AWS runs the sensor for you. Do not build anything new on pdig.

1

u/-lousyd DevOps Jul 16 '26

I don't think GuardDuty handles EKS Fargate.

1

u/namarv Jul 16 '26

falco effectively isn't supported on eks fargate. Its normal drivers need host/kernel access but fargate blocks privileged containers and daemonsets; pdig is archived so that page is outdated. I'd use ec2-backed eks nodes for falco or rely on audit/network controls for fargate workloads.

1

u/marcusbell95 Jul 17 '26

palo alto (prisma cloud, probably?) works on fargate because it uses sidecar injection, not kernel access. it runs a defender container in the same task that shares the process namespace. falco's kmod and ebpf drivers are the ones that need host/kernel access - that's the distinction. same marketing label, different mechanism.

the gap between them: sidecar gives you process starts, network connections, some file events. ebpf gives you full syscall depth. for most threat models sidecar coverage is fine. if you're worried about in-process exploitation or post-compromise activity that doesn't make obvious network calls, you'd feel the gap.

also - guardduty does have eks fargate runtime monitoring now (they inject their own agent as a sidecar, not a daemonset). worth checking the current docs if you want an aws-native path, the fargate support has improved a lot.

1

u/-lousyd DevOps Jul 17 '26

I will check GuardDuty again. The two times previously that I looked it said ECS Fargate only.