<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Container Runtime Security Reference

Falco and Tetragon rule authoring for container runtime protection.

## Falco Rule Structure
```yaml
- rule: Rule Name
  desc: Description
  condition: syscall/k8s audit condition
  output: formatted output string
  priority: EMERGENCY|ALERT|CRITICAL|ERROR|WARNING|NOTICE|INFO|DEBUG
  tags: [container, network, mitre_*]
```

## Key Detection Categories
1. Container escape (nsenter, mount, capability abuse)
2. Cryptomining (known miner processes, stratum protocol)
3. Sensitive file access (credentials, keys, tokens)
4. Reverse shells (socket + exec patterns)
5. Privilege escalation (setuid, capability changes)
6. Network anomalies (unexpected outbound connections)
7. K8s API abuse (secret access, RBAC changes)

## Tetragon (eBPF-based)
- Lower overhead than Falco (kernel-level enforcement)
- Can block (not just detect) malicious syscalls
- TracingPolicy CRD for Kubernetes-native configuration
