Find the Pod Reading /dev/mem and Contain It

Original Prepium guide · Written for Kubernetes v1.35 and checked against the official documentation on 6 October 2026. Use a disposable practice cluster. Assumes Falco is already running on the nodes (for example as a DaemonSet); paths below are Falco's documented defaults.

Catch a misbehaving container with a Falco rule, then trace it to its Pod

Falco watches system calls on each node and raises an alert whenever an event matches a rule's condition. The alert text is built from the rule's output, where fields such as %container.id and %k8s.pod.name are filled in. A runtime-security task is usually two skills: write or read a rule that isolates the behaviour, then turn the alert into a Kubernetes object you can act on.

syscall (openat /etc/shadow) ──→ Falco rule condition ──→ alert on stdout/syslog/file
alert: container.id ──→ crictl ps (POD ID) ──→ crictl pods (NAME, NAMESPACE) ──→ ownerReferences

1. Know the building blocks

• A rule needs rule, desc, condition, output and priority; tags and enabled are optional.
• A macro is a reusable piece of condition; a list is a named set of values you can use with in.
• Useful fields: evt.type (syscall name), evt.is_open_read, fd.name (full path for files), proc.name (truncated to 16 characters), proc.cmdline, container.id (12-character ID, or host outside containers), k8s.pod.name, k8s.ns.name.

2. Write a rule for your own sensitive file

This example flags any container reading /etc/shadow, with an allow list for a legitimate helper. Save it in a file under a directory listed in rules_files; the default falco.yaml loads /etc/falco/falco_rules.yaml, then falco_rules.local.yaml, then /etc/falco/rules.d. With a Helm install, ship it through the chart's custom rules values instead.

- list: prepium_shadow_readers_allowed
  items: [unix_chkpwd]

- macro: prepium_reads_shadow
  condition: >
    evt.type in (open, openat, openat2)
    and evt.is_open_read=true
    and fd.name=/etc/shadow

- rule: Shadow file read inside a container
  desc: A containerised process opened /etc/shadow for reading
  condition: >
    prepium_reads_shadow
    and container.id != host
    and not proc.name in (prepium_shadow_readers_allowed)
  output: >
    shadow read (proc=%proc.name cmd=%proc.cmdline file=%fd.name
    container=%container.id image=%container.image.repository
    pod=%k8s.pod.name ns=%k8s.ns.name)
  priority: WARNING
  tags: [prepium, filesystem]

The default watch_config_files: true makes Falco reload when rules files change. Read Falco's own log after saving to confirm the rules loaded without errors.

3. Trigger it and read the alert

kubectl create namespace prepium-tutorial
kubectl -n prepium-tutorial run shadow-peek --image=alpine:3.20 \
  --command -- sh -c 'while true; do cat /etc/shadow >/dev/null; sleep 15; done'
kubectl -n prepium-tutorial get pod shadow-peek -o wide
kubectl -n falco get pods -o wide
kubectl -n falco logs <falco-pod-on-that-node> | grep 'shadow read'

Falco is per node, so read the instance on the node that runs the suspect Pod. Alerts go to every enabled channel: the stock falco.yaml enables stdout_output and syslog_output and leaves file_output off. Set json_output: true if you prefer machine-readable lines.

4. Map a container ID to its Pod and owner

If the Kubernetes fields in an alert are empty (metadata lookups can lag), fall back to the container runtime on that node:

sudo crictl ps | grep <container-id>        # note the POD ID column
sudo crictl pods | grep <pod-id>            # NAME and NAMESPACE of the Pod
kubectl -n <namespace> get pod <name> -o jsonpath='{.metadata.ownerReferences[0].kind}/{.metadata.ownerReferences[0].name}'

A Deployment's Pod is owned by a ReplicaSet, which is in turn owned by the Deployment, so follow ownerReferences twice. Deleting only the Pod rarely contains anything: its controller simply creates a new one.

Common mistakes

• Matching only evt.type=open: reads made through openat or openat2 slip past. List every open variant you care about.
• Forgetting container.id != host: host daemons that legitimately read the file flood the output.
• Checking the Falco Pod on the wrong node and concluding the rule does not work.
• Relying on proc.name for long binary names: it is truncated to 16 characters, so exact matches fail.

Cleanup: kubectl delete namespace prepium-tutorial and remove your rules file. References: Falco rule basic elements, Supported fields, Output channels, Debugging nodes with crictl. Next, try API audit logging or image admission policy.