detecting-container-escape-with-falco-rules
Write and tune Falco rules that monitor Linux syscalls to detect container escape techniques in real time, including host filesystem mounts, sensitive host path access, kernel module loading, and abuse of privileged container capabilities. Use when deploying or tuning Falco for a Kubernetes/container environment, or when investigating an alert tied to syscall-level escape behavior.
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.