export CONTAINER_REPO=${USER}test.azurecr.io/falco-with-ig
export IMAGE_TAG=latest
PLATFORMS=linux/amd64 make container-build

docker pull $CONTAINER_REPO:$IMAGE_TAG
docker run --rm -i -t \
           --privileged \
           -v /var/run/docker.sock:/host/var/run/docker.sock \
           -v /sys/kernel/tracing:/sys/kernel/tracing \
           -v /proc:/host/proc:ro \
           $CONTAINER_REPO:$IMAGE_TAG falco --modern-bpf

Critical Some event (ig.gadget=trace exec ig.comm=ssh)

export OCI_FALCO_PLUGIN=${USER}test.azurecr.io/falco-plugin-ig
export OCI_FALCO_PLUGIN_VERSION=0.1.0
make falco-plugin

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco \
    --namespace falco --create-namespace \
    --set-string driver.kind=modern-bpf \
    --set-string \
        falcoctl.config.artifact.allowedTypes='{rulesfile,plugin}' \
    --set-string \
        falcoctl.config.artifact.install.refs='{albantest.azurecr.io/falco-plugin-ig:0.1.0,albantest.azurecr.io/falco-plugin-ig-ruleset:0.1.0}' \
    --set-string \
        falco.load_plugins='{ig}' \
    --set-string falco.plugins[0].name=ig \
    --set-string falco.plugins[0].library_path=libfalco-plugin-ig.so \
    --set-string falco.plugins[0].init_config.gadget=mygadget \
    --set-string \
        falco.rules_file='{/etc/falco/ig_rules.yaml}' \
    --set-string mounts.volumes[0].name='tracefs' \
    --set-string mounts.volumes[0].hostPath.path='/sys/kernel/tracing' \
    --set-string mounts.volumeMounts[0].name='tracefs' \
    --set-string mounts.volumeMounts[0].mountPath='/sys/kernel/tracing'

kubectl logs $(kubectl get pod -n falco -o name) -n falco

helm uninstall falco -n falco