Questão de System Administration #019e3a4f

The correct answer is Falco, an open source runtime security tool designed to detect anomalous activity in cloud-native environments, including containers, Kubernetes, and hosts. Falco uses a set of rules to monitor system calls and kernel events, alerting on suspicious behavior such as privilege escalation, file access, or network connections.

How it Works

Falco operates by hooking into the Linux kernel's system call interface (via eBPF or a kernel module) to capture events. It then evaluates these events against a configurable rules engine. When a rule matches, Falco generates an alert that can be sent to various outputs (e.g., stdout, syslog, or external integrations like Slack or PagerDuty). This allows security teams to detect threats in real time.

Why Falco is Correct

Falco is explicitly designed for runtime security. It is a Cloud Native Computing Foundation (CNCF) incubating project and is widely used for intrusion detection and compliance monitoring in containerized environments. Its primary function is security monitoring, not container runtime or virtualization.

Why Other Options are Incorrect

• lxd: This is a container hypervisor and system container manager, not a security tool. It provides a secure environment for running containers but does not perform runtime security monitoring.
• containerd: This is an industry-standard container runtime that manages the container lifecycle (creating, starting, stopping containers). It is a core component of Docker and Kubernetes but lacks built-in security detection capabilities.
• gvisor: This is a sandboxed container runtime that provides an additional layer of isolation by intercepting system calls from containers. While it enhances security through sandboxing, it is not a runtime security tool for monitoring and alerting; it is a runtime itself.