document Falco runtime topology

2026-08-15 14:22:56 -04:00
parent 2ca1b150cc
commit 5c1e6205a7
3 changed files with 70 additions and 0 deletions
@@ -75,6 +75,12 @@ application workloads in the `default` namespace are rejected. Falco runtime
 testing has verified that the suspicious shell workload produces the custom
 shell detection while the compliant workload does not.

+The local k3d cluster runs its node containers on one Flatcar host kernel, so
+multiple Falco Pods can observe the same kernel event. This can create duplicate
+notifications during local demonstrations. The production-style separate-VM
+path gives each node its own kernel. See [`docs/runtime-detection.md`](docs/runtime-detection.md)
+for the topology distinction and alerting implications.
+
 ## Build status

 - [x] Phase 1: local k3d definition and optional Terraform/Ansible path