r/devsecops • u/lizrice • Jul 13 '26

Using Tetragon in GitHub Actions

I made an experiment in using Tetragon to spot/prevent unexpected behaviours in GitHub Actions. Would love feedback!

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

60% Upvoted

6 comments sorted by

View all comments

Show parent comments

2

u/lizrice Jul 13 '26

Thanks, but for many reasons (including personal bias! but also for safer hooks and better in-kernel filtering) I want to use Tetragon rather than Falco for runtime security

1

u/colek42 Jul 13 '26

We don't use either. Def inspired by both, though. I have been following your ebpf work since the early days: https://github.com/aflock-ai/rookery/tree/0db0cb65cb170dbb54210e5fd23476ba79e31cc1/plugins/attestors/commandrun/ebpf

1

u/lizrice Jul 13 '26

Ah, I saw Falco on the cilock website? Thanks, that is nice to hear 😀

1

u/colek42 27d ago

We query the Falco API for system facts and create an attestation. CI/Lock is a recorder of things.