CrowdStrike logo

falcon-bootc

Configuration for creating a bootc-based image with the Falcon sensor installed.

This is an example that users should adapt to their bootc workflow. The resulting image will be
associated with a specific customer ID (CID). Upon startup, the host will generate a new agent ID (AID).

Support

falcon-bootc is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

Prerequisites

RHEL setup

Install Podman
Log in to the Red Hat registry:

podman login registry.redhat.io
# enter your Red Hat login

Mac setup

Install Podman
Create a Podman machine with rootful and a volume mount:

podman machine init --rootful -v $HOME/projects:$HOME/projects

podman login registry.redhat.io
# enter your Red Hat login

Register the Podman machine so it has access to subscription content (don't copy and paste both commands into the terminal, you need to start the SSH session then register):

podman machine ssh
# then inside the ssh session...
subscription-manager register
# enter your Red Hat login

Building

Download a GPG key and RPM that matches the system's architecture and place them in assets. Note: the Containerfile installs any *.gpg and *.rpm file found, so ensure the files match this convention.
Retrieve your CID and set as as environment variable: FALCON_CID=abcd1234
Build the container image: podman build --build-arg FALCON_CID=$FALCON_CID -t falcon-bootc-demo:latest .
Build the bootable image:

podman run \
  --rm \
  --privileged \
  --pull=newer \
  --security-opt label=type:unconfined_t \
  -v ./config.toml:/config.toml \
  -v ./output:/output \
  -v /var/lib/containers/storage:/var/lib/containers/storage \
  registry.redhat.io/rhel9/bootc-image-builder:latest \
  --type iso \
  --config /config.toml \
  --local=true \
  localhost/falcon-bootc-demo:latest

Launch a VM with the ISO as the boot disk.

README