<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Container Escape Detection — API Reference

## Falco CLI

```bash
# Run Falco with custom rules
falco -r /etc/falco/escape_rules.yaml

# Output as JSON
falco -r rules.yaml -o json_output=true

# Dry-run rule validation
falco -r rules.yaml --dry-run

# List loaded rules
falco --list
```

## Falco Rule Fields

| Field | Description |
|-------|-------------|
| `container.id` | Container ID |
| `container.name` | Container name |
| `container.image.repository` | Image name |
| `proc.name` | Process name |
| `proc.cmdline` | Full command line |
| `proc.args` | Process arguments |
| `fd.name` | File descriptor name |
| `user.name` | Username |
| `evt.type` | System call type |

## Tetragon CLI

```bash
# Apply tracing policy
kubectl apply -f tracing-policy.yaml

# Get events
kubectl logs -n kube-system ds/tetragon -c export-stdout -f | \
  jq 'select(.process_exec != null)'

# Filter escape-related events
tetra getevents -o compact | grep -E "setns|mount|unshare"
```

## Auditd Commands

```bash
# Search escape-related events
ausearch -k container_escape --start today

# Generate report
aureport -k --start today

# Monitor in real-time
ausearch -k container_escape --start recent -i
```

## Key Syscalls for Escape Detection

| Syscall | Purpose | Risk |
|---------|---------|------|
| `setns` | Enter namespace | Critical — namespace escape |
| `unshare` | Create new namespace | High — namespace manipulation |
| `mount` | Mount filesystem | Critical — host filesystem access |
| `ptrace` | Process tracing | High — process manipulation |
| `clone` | Create process with flags | Medium — namespace flags |
