April 2017 Summaries

Jorge Salamero Sanz's article offers a detailed guide on monitoring Docker Swarm using Sysdig Monitor, emphasizing the importance of leveraging container orchestration platform metadata for effective service monitoring and troubleshooting. Docker Swarm, central to Docker's container orchestration, benefits from Sysdig's ability to automatically import and analyze Swarm metadata, providing comprehensive monitoring across host, container, network, and application data without extra user instrumentation. The article explains Docker Swarm's core components, like services, stacks, and tasks, and how Sysdig Monitor utilizes these to offer dynamic infrastructure grouping, metric analysis, and alerting capabilities. It highlights the availability of pre-built dashboards for Swarm monitoring, including Swarm Overview and Swarm Services, featuring metrics and alerts for issues like slow service response time or cluster quorum loss. Additionally, the article outlines Sysdig's multi-tenant capabilities, enabling restricted visibility based on team configurations, and concludes with steps to start monitoring a Docker Swarm cluster using Sysdig.

Falco 0.6.0 introduces several enhancements and new features, aiming to improve functionality and security for users. This release includes the addition of tags to Falco rules, allowing users to categorize and manage rules more efficiently by enabling or disabling them based on tags such as "filesystem," "software_mgmt," and "container." A notable update is the introduction of a standalone kernel module, falco-probe, which allows independent updates from sysdig without compatibility issues. The release also offers support for compiling on OSX, includes sample Kubernetes YAML files for deployment, and has undergone security scanning for the Falco Docker image with updates to third-party libraries. Additionally, the update addresses numerous rule changes to reduce false positives, particularly in scenarios involving Kubernetes liveness checks and security software operations. Users can access the complete set of changes through the changelog on GitHub, with the release available via RPM/Debian packages, Docker Hub, and GitHub.