Falco
Monitor Linux host and container activity with Falco's modern eBPF engine. Includes Falcosidekick UI, persistent event storage, and optional Telegram alerts.
Deploy Falco on Dokploy
- Install Dokploy on your server if you haven't already.
- In your Dokploy panel, open a project and click Create Service → Template.
- Search for Falco and click Create — Dokploy configures domains, environment variables, and volumes for you.
Alternatively, create a Compose service, go to Advanced → Import from Base64, and paste this payload:
ewogICJjb21wb3NlIjogIngtbG9nZ2luZzogJmRlZmF1bHQtbG9nZ2luZ1xuICBkcml2ZXI6IGpzb24tZmlsZVxuICBvcHRpb25zOlxuICAgIG1heC1zaXplOiBcIjEwbVwiXG4gICAgbWF4LWZpbGU6IFwiM1wiXG5cbnNlcnZpY2VzOlxuICBmYWxjbzpcbiAgICBpbWFnZTogZmFsY29zZWN1cml0eS9mYWxjbzowLjQ1LjBcbiAgICBob3N0bmFtZTogXCIke01PTklUT1JFRF9IT1NUOi1kb2twbG95fVwiXG4gICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWRcbiAgICBjYXBfZHJvcDpcbiAgICAgIC0gQUxMXG4gICAgY2FwX2FkZDpcbiAgICAgIC0gU1lTX0FETUlOXG4gICAgICAtIFNZU19SRVNPVVJDRVxuICAgICAgLSBTWVNfUFRSQUNFXG4gICAgc2VjdXJpdHlfb3B0OlxuICAgICAgLSBhcHBhcm1vcjp1bmNvbmZpbmVkXG4gICAgZW52aXJvbm1lbnQ6XG4gICAgICBIT1NUX1JPT1Q6IC9ob3N0XG4gICAgY29tbWFuZDpcbiAgICAgIC0gL3Vzci9iaW4vZmFsY29cbiAgICAgIC0gLW9cbiAgICAgIC0gZW5naW5lLmtpbmQ9bW9kZXJuX2VicGZcbiAgICAgIC0gLW9cbiAgICAgIC0ganNvbl9vdXRwdXQ9dHJ1ZVxuICAgICAgLSAtb1xuICAgICAgLSBqc29uX2luY2x1ZGVfb3V0cHV0X3Byb3BlcnR5PXRydWVcbiAgICAgIC0gLW9cbiAgICAgIC0gc3Rkb3V0X291dHB1dC5lbmFibGVkPXRydWVcbiAgICAgIC0gLW9cbiAgICAgIC0gaHR0cF9vdXRwdXQuZW5hYmxlZD10cnVlXG4gICAgICAtIC1vXG4gICAgICAtIGh0dHBfb3V0cHV0LnVybD1odHRwOi8vZmFsY29zaWRla2ljazoyODAxL1xuICAgICAgLSAtb1xuICAgICAgLSBwcmlvcml0eT1ub3RpY2VcbiAgICAjIEZhbGNvIG5lZWRzIHRoZSByZWFsIGhvc3QgcGF0aHMgdG8gaW5zcGVjdCBob3N0IGFuZCBjb250YWluZXIgYWN0aXZpdHkuXG4gICAgdm9sdW1lczpcbiAgICAgIC0gdHlwZTogYmluZFxuICAgICAgICBzb3VyY2U6IC92YXIvcnVuL2RvY2tlci5zb2NrXG4gICAgICAgIHRhcmdldDogL2hvc3QvdmFyL3J1bi9kb2NrZXIuc29ja1xuICAgICAgICByZWFkX29ubHk6IHRydWVcbiAgICAgICAgYmluZDpcbiAgICAgICAgICBjcmVhdGVfaG9zdF9wYXRoOiBmYWxzZVxuICAgICAgLSB0eXBlOiBiaW5kXG4gICAgICAgIHNvdXJjZTogL3Byb2NcbiAgICAgICAgdGFyZ2V0OiAvaG9zdC9wcm9jXG4gICAgICAgIHJlYWRfb25seTogdHJ1ZVxuICAgICAgICBiaW5kOlxuICAgICAgICAgIGNyZWF0ZV9ob3N0X3BhdGg6IGZhbHNlXG4gICAgICAtIHR5cGU6IGJpbmRcbiAgICAgICAgc291cmNlOiAvZXRjXG4gICAgICAgIHRhcmdldDogL2hvc3QvZXRjXG4gICAgICAgIHJlYWRfb25seTogdHJ1ZVxuICAgICAgICBiaW5kOlxuICAgICAgICAgIGNyZWF0ZV9ob3N0X3BhdGg6IGZhbHNlXG4gICAgICAtIHR5cGU6IGJpbmRcbiAgICAgICAgc291cmNlOiAvc3lzL2tlcm5lbC90cmFjaW5nXG4gICAgICAgIHRhcmdldDogL3N5cy9rZXJuZWwvdHJhY2luZ1xuICAgICAgICByZWFkX29ubHk6IHRydWVcbiAgICAgICAgYmluZDpcbiAgICAgICAgICBjcmVhdGVfaG9zdF9wYXRoOiBmYWxzZVxuICAgIGRlcGVuZHNfb246XG4gICAgICBmYWxjb3NpZGVraWNrOlxuICAgICAgICBjb25kaXRpb246IHNlcnZpY2Vfc3RhcnRlZFxuICAgIG1lbV9saW1pdDogMWdcbiAgICBzdG9wX2dyYWNlX3BlcmlvZDogMzBzXG4gICAgbG9nZ2luZzogKmRlZmF1bHQtbG9nZ2luZ1xuXG4gIGZhbGNvc2lkZWtpY2s6XG4gICAgaW1hZ2U6IGZhbGNvc2VjdXJpdHkvZmFsY29zaWRla2ljazoyLjM1LjBcbiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZFxuICAgIGVudmlyb25tZW50OlxuICAgICAgVEVMRUdSQU1fVE9LRU46IFwiJHtURUxFR1JBTV9CT1RfVE9LRU46LX1cIlxuICAgICAgVEVMRUdSQU1fQ0hBVElEOiBcIiR7VEVMRUdSQU1fQ0hBVF9JRDotfVwiXG4gICAgICBURUxFR1JBTV9NSU5JTVVNUFJJT1JJVFk6IFwiJHtURUxFR1JBTV9NSU5JTVVNX1BSSU9SSVRZOi1ub3RpY2V9XCJcbiAgICAgIFdFQlVJX1VSTDogaHR0cDovL2ZhbGNvLXVpOjI4MDJcbiAgICBkZXBlbmRzX29uOlxuICAgICAgZmFsY28tdWk6XG4gICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9zdGFydGVkXG4gICAgY2FwX2Ryb3A6XG4gICAgICAtIEFMTFxuICAgIHNlY3VyaXR5X29wdDpcbiAgICAgIC0gbm8tbmV3LXByaXZpbGVnZXM6dHJ1ZVxuICAgIG1lbV9saW1pdDogMjU2bVxuICAgIHN0b3BfZ3JhY2VfcGVyaW9kOiAzMHNcbiAgICBsb2dnaW5nOiAqZGVmYXVsdC1sb2dnaW5nXG5cbiAgZmFsY28tdWk6XG4gICAgaW1hZ2U6IGZhbGNvc2VjdXJpdHkvZmFsY29zaWRla2ljay11aToyLjMuMVxuICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkXG4gICAgZW52aXJvbm1lbnQ6XG4gICAgICBGQUxDT1NJREVLSUNLX1VJX1VTRVI6IFwiJHtGQUxDT19VSV9VU0VSOi1hZG1pbn06JHtGQUxDT19VSV9QQVNTV09SRDo/U2V0IEZBTENPX1VJX1BBU1NXT1JEfVwiXG4gICAgICBGQUxDT1NJREVLSUNLX1VJX1JFRElTX1VSTDogZmFsY28tcmVkaXM6NjM3OVxuICAgICAgRkFMQ09TSURFS0lDS19VSV9SRURJU19QQVNTV09SRDogXCIke0ZBTENPX1JFRElTX1BBU1NXT1JEOj9TZXQgRkFMQ09fUkVESVNfUEFTU1dPUkR9XCJcbiAgICAgIEZBTENPU0lERUtJQ0tfVUlfVFRMOiBcIjE2OGhcIlxuICAgIGV4cG9zZTpcbiAgICAgIC0gXCIyODAyXCJcbiAgICBkZXBlbmRzX29uOlxuICAgICAgZmFsY28tcmVkaXM6XG4gICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5XG4gICAgY2FwX2Ryb3A6XG4gICAgICAtIEFMTFxuICAgIHNlY3VyaXR5X29wdDpcbiAgICAgIC0gbm8tbmV3LXByaXZpbGVnZXM6dHJ1ZVxuICAgIG1lbV9saW1pdDogMjU2bVxuICAgIHN0b3BfZ3JhY2VfcGVyaW9kOiAzMHNcbiAgICBsb2dnaW5nOiAqZGVmYXVsdC1sb2dnaW5nXG5cbiAgZmFsY28tcmVkaXM6XG4gICAgaW1hZ2U6IHJlZGlzL3JlZGlzLXN0YWNrLXNlcnZlcjo3LjQuMC12OFxuICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkXG4gICAgIyBGYWxjb3NpZGVraWNrIFVJIG5lZWRzIFJlZGlTZWFyY2ggYW5kIFJlZGlzSlNPTiwgbm90IFJlZGlzR2VhcnMgb3IgUmVkaXNBSS5cbiAgICBjb21tYW5kOlxuICAgICAgLSAvb3B0L3JlZGlzLXN0YWNrL2Jpbi9yZWRpcy1zZXJ2ZXJcbiAgICAgIC0gLS1kaXJcbiAgICAgIC0gL2RhdGFcbiAgICAgIC0gLS1sb2FkbW9kdWxlXG4gICAgICAtIC9vcHQvcmVkaXMtc3RhY2svbGliL3JlZGlzZWFyY2guc29cbiAgICAgIC0gLS1sb2FkbW9kdWxlXG4gICAgICAtIC9vcHQvcmVkaXMtc3RhY2svbGliL3JlanNvbi5zb1xuICAgICAgLSAtLXJlcXVpcmVwYXNzXG4gICAgICAtIFwiJHtGQUxDT19SRURJU19QQVNTV09SRDo/U2V0IEZBTENPX1JFRElTX1BBU1NXT1JEfVwiXG4gICAgICAtIC0tYXBwZW5kb25seVxuICAgICAgLSBcInllc1wiXG4gICAgICAtIC0tYXBwZW5kZnN5bmNcbiAgICAgIC0gZXZlcnlzZWNcbiAgICAgIC0gLS1tYXhtZW1vcnlcbiAgICAgIC0gNTEybWJcbiAgICAgIC0gLS1tYXhtZW1vcnktcG9saWN5XG4gICAgICAtIG5vZXZpY3Rpb25cbiAgICBlbnZpcm9ubWVudDpcbiAgICAgIFJFRElTQ0xJX0FVVEg6IFwiJHtGQUxDT19SRURJU19QQVNTV09SRDo/U2V0IEZBTENPX1JFRElTX1BBU1NXT1JEfVwiXG4gICAgdm9sdW1lczpcbiAgICAgIC0gZmFsY28tZXZlbnRzOi9kYXRhXG4gICAgaGVhbHRoY2hlY2s6XG4gICAgICB0ZXN0OiBbXCJDTURcIiwgXCJyZWRpcy1jbGlcIiwgXCJwaW5nXCJdXG4gICAgICBpbnRlcnZhbDogMTBzXG4gICAgICB0aW1lb3V0OiA1c1xuICAgICAgcmV0cmllczogNVxuICAgICAgc3RhcnRfcGVyaW9kOiAyMHNcbiAgICBtZW1fbGltaXQ6IDFnXG4gICAgc3RvcF9ncmFjZV9wZXJpb2Q6IDMwc1xuICAgIGxvZ2dpbmc6ICpkZWZhdWx0LWxvZ2dpbmdcblxudm9sdW1lczpcbiAgZmFsY28tZXZlbnRzOiIsCiAgImNvbmZpZyI6ICJbdmFyaWFibGVzXVxubWFpbl9kb21haW4gPSBcIiR7ZG9tYWlufVwiXG51aV9wYXNzd29yZCA9IFwiJHtoYXNoOjY0fVwiXG5yZWRpc19wYXNzd29yZCA9IFwiJHtoYXNoOjY0fVwiXG5cbltjb25maWddXG5lbnYgPSBbXG4gICMgTmFtZSBzaG93biBmb3IgdGhpcyBob3N0IGluIGFsZXJ0cy5cbiAgXCJNT05JVE9SRURfSE9TVD1kb2twbG95XCIsXG4gICMgT3B0aW9uYWwgVGVsZWdyYW0gbm90aWZpY2F0aW9uczsgbGVhdmUgYm90aCBjcmVkZW50aWFscyBlbXB0eSB0byBkaXNhYmxlLlxuICBcIlRFTEVHUkFNX0JPVF9UT0tFTj1cIixcbiAgXCJURUxFR1JBTV9DSEFUX0lEPVwiLFxuICBcIlRFTEVHUkFNX01JTklNVU1fUFJJT1JJVFk9bm90aWNlXCIsXG4gIFwiRkFMQ09fVUlfVVNFUj1hZG1pblwiLFxuICBcIkZBTENPX1VJX1BBU1NXT1JEPSR7dWlfcGFzc3dvcmR9XCIsXG4gIFwiRkFMQ09fUkVESVNfUEFTU1dPUkQ9JHtyZWRpc19wYXNzd29yZH1cIlxuXVxubW91bnRzID0gW11cblxuW1tjb25maWcuZG9tYWluc11dXG5zZXJ2aWNlTmFtZSA9IFwiZmFsY28tdWlcIlxucG9ydCA9IDI4MDJcbmhvc3QgPSBcIiR7bWFpbl9kb21haW59XCIiCn0=
Configuration
The exact Docker Compose and template configuration this template deploys.
Instructions
Falco
This template runs Falco with the modern eBPF engine and stores events in Redis Stack for Falcosidekick UI. Telegram alerts through Falcosidekick are optional.
Host requirements
- Use Docker Compose on a Linux server with a kernel that supports modern eBPF (normally Linux 5.8 or later) and kernel BTF at
/sys/kernel/btf/vmlinux. - The Docker socket,
/proc,/etc, and/sys/kernel/tracingmust exist on the deployment server. Falco mounts these host paths read-only to inspect activity. Unlike application data, these paths must refer to the real host directories. - If tracefs is mounted at
/sys/kernel/debug/tracing, change only the tracing bind mount'ssourceto that path and keep itstargetas/sys/kernel/tracing. - Falco needs
SYS_ADMIN,SYS_RESOURCE, andSYS_PTRACE, with an unconfined AppArmor profile. Rootless Docker and hosts that prohibit these capabilities are not supported by this template. - The service memory limits total 2.5 GiB. Leave additional memory for Dokploy, the operating system, and other applications.
See Falco's container deployment guide for the supported host configuration.
Before deploying
Set these values in Dokploy's Environment tab:
| Variable | Value |
|---|---|
MONITORED_HOST | A hostname label for the monitored server, such as production-01. This appears in alerts and is not the UI domain. |
TELEGRAM_BOT_TOKEN | Optional. Leave empty to disable Telegram alerts, or set it together with TELEGRAM_CHAT_ID to enable them. |
TELEGRAM_CHAT_ID | Optional. The target chat ID, including its leading minus sign for a group chat. Set it together with TELEGRAM_BOT_TOKEN. |
TELEGRAM_MINIMUM_PRIORITY | Defaults to notice. Filters Telegram alerts when Telegram is configured. |
FALCO_UI_USER | Defaults to admin. |
FALCO_UI_PASSWORD | Generated automatically when you import the template. |
FALCO_REDIS_PASSWORD | Generated automatically when you import the template. |
For deployment without Telegram, leave TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID empty. Falco still detects events and sends them to the dashboard. Only the monitored hostname and the UI and Redis passwords are required.
To enable Telegram alerts, provide both credentials, start a conversation with the bot or add it to the target group, and redeploy.
The generated passwords are independent 64-character hexadecimal strings. To replace one, generate a new value with openssl rand -hex 32. Keep the Redis password unchanged across redeployments unless you also update all services that use it.
Falco collects events at notice or higher. Changing TELEGRAM_MINIMUM_PRIORITY only filters Telegram delivery; it does not change Falco's collection threshold or the events sent to the UI.
Open the dashboard
Deploy with Dokploy's isolated deployments enabled. Open the domain assigned to falco-ui on port 2802 and log in with FALCO_UI_USER and FALCO_UI_PASSWORD. Enable HTTPS for that domain in Dokploy.
Dokploy manages the stack's network and domain routing. No host ports are published. Redis loads the RediSearch and RedisJSON modules required by the UI, requires authentication, and stores data in the falco-events volume, with append-only persistence and a seven-day UI event lifetime.
Verify alerts
On the monitored server, start an interactive shell in a disposable container:
bash
Exit the shell after it starts. Check the Falco logs and dashboard for the Terminal shell in container event. Its hostname should match MONITORED_HOST. If Telegram is configured, check the Telegram chat as well.
Related Templates
Agent DVR
Version: latest
Agent DVR is a comprehensive video surveillance software with motion detection, alerts, and remote access capabilities.
Checkcle
Version: latest
Checkcle is a security and compliance tool by Operacle, providing insights into system configuration and runtime checks.
Wazuh
Version: 4.14.8
Open source security platform (SIEM/XDR): threat detection, integrity monitoring, vulnerability detection and compliance. Single-node manager, indexer and dashboard.
3Dokploy
Version: 0.1.1
A live, isometric 3D view of your Dokploy: projects as buildings, services as racks, deploys rolling in on carts, network traffic as packets. Read-only.
AdGuard Home
Version: latest
AdGuard Home is a network-wide ad and tracker blocker. Self-host it on your own server with Dokploy, which deploys AdGuard Home as a Docker Compose service in a few clicks.
Authelia
Version: latest
Authelia is an open-source authentication portal for single sign-on (SSO) and two-factor authentication. Self-host it on your own server with Dokploy, which deploys Authelia as a Docker Compose service in a few clicks.
Self-host Falco in minutes
Dokploy is a free, open source deployment platform. Deploy Falco and 585+ other templates on your own infrastructure with a single click.