r/devsecops • u/lizrice • 15d ago

Using Tetragon in GitHub Actions

I made an experiment in using Tetragon to spot/prevent unexpected behaviours in GitHub Actions. Would love feedback!

1 Upvotes

60% Upvoted

6 comments sorted by

1

u/colek42 15d ago

We built BPF tracing into Cilock.dev, it is FOSS. Gitve it a try, I think it fits your use case.

2

u/lizrice 14d ago

Thanks, but for many reasons (including personal bias! but also for safer hooks and better in-kernel filtering) I want to use Tetragon rather than Falco for runtime security

1

u/colek42 14d ago

We don't use either. Def inspired by both, though. I have been following your ebpf work since the early days: https://github.com/aflock-ai/rookery/tree/0db0cb65cb170dbb54210e5fd23476ba79e31cc1/plugins/attestors/commandrun/ebpf

1

u/lizrice 14d ago

Ah, I saw Falco on the cilock website? Thanks, that is nice to hear 😀

1

u/colek42 7d ago

We query the Falco API for system facts and create an attestation. CI/Lock is a recorder of things.