document Falco runtime topology

2026-08-15 14:22:56 -04:00
parent 2ca1b150cc
commit 5c1e6205a7
3 changed files with 70 additions and 0 deletions
@@ -49,3 +49,9 @@ Falco workloads after the alerting integration is configured.
 The repository verifies Falco runtime detections locally. Webhook delivery is
 enabled by the Git-managed Falcosidekick resources after the Secret exists, and
 still requires an interactive Slack or Discord credential for end-to-end testing.
+
+For runtime alert interpretation, see
+[`docs/runtime-detection.md`](../../docs/runtime-detection.md). The local k3d
+nodes share one Flatcar host kernel, so duplicate Falco notifications are
+possible. Separate VM nodes provide distinct kernels and are the more realistic
+production-style validation path.