Falco vs Red Hat OpenShift Pipelines

Falco is a free, open source runtime security project for Linux and self-hosted environments. It monitors hosts, containers, Kubernetes, and cloud environments for abnormal behavior, potential threats, and compliance violations in real time. Events are compared with built-in detection rules, and users can create rules for their own environments. Sources include Linux kernel system calls, Kubernetes audit logs, cloud events such as AWS CloudTrail, and events from GitHub and Okta. For kernel event monitoring, Falco uses an eBPF driver by default and offers a kernel module for wider compatibility. Installation options cover Linux hosts, Docker containers, and Kubernetes, including official Helm charts; supported architectures include x86_64 and ARM64. Falcosidekick can forward events to more than 50 systems, including email, chat, message queues, serverless functions, and databases. Falco is hosted by the CNCF as a graduated project. Detection depends on having appropriate rules in place, while resource use varies with server load and workload. The project recommends testing performance in the target environment.

Red Hat OpenShift Pipelines automates application delivery on Red Hat OpenShift using a cloud-native CI/CD system built on Tekton. Pipelines are defined with Kubernetes resources and standard Tekton custom resource definitions, supporting portable pipeline definitions. Runs execute with their dependencies in isolated containers and can scale on demand, a fit for decentralized teams working with microservice-based architectures. The OpenShift Developer console can create Tekton resources, show run logs and manage pipelines in namespaces. Documented image-building tools include Source-to-Image, Buildah, Buildpacks and Kaniko. Red Hat lists integrations with Tekton Pipelines, Tekton Triggers, Tekton Chains, Tekton Results and OpenShift GitOps. Pipelines as Code supports versioned, auditable workflows aligned with GitOps practices. Red Hat describes hardened security and a Trusted Supply Chain framework intended to help ensure integrity and conform with SLSA levels. The product is available with a Red Hat OpenShift subscription and included in OpenShift Container Platform. The documented CI/CD system runs on OpenShift Container Platform. Pricing is on request; the Developer Sandbox offers a 30-day trial.