Falco on Kubernetes: Runtime Security with eBPF

Originally published on DevToolHub. Most K8s security tools scan configs. Falco watches what containers actually do at runtime. It runs as a DaemonSet and monitors kernel system calls via eBPF. When