## Runtime Protection

Scanning images is "Static". We also need "Dynamic" protection (EDR for Containers).

### Falco (The Runtime Camera)
**Falco** is an open-source tool (CNCF) that watches the Kernel.
*   **Rule**: "Alert if a Shell is spawned in a container."
*   **Rule**: "Alert if a container modifies `/etc/shadow`."
*   **Rule**: "Alert if a container connects to a crypto-mining pool."

### Sidecars
Security tools often run as a "Sidecar" container next to the main app container in the same Pod. They share the network view and can inspect localhost traffic.

### eBPF (Extended Berkeley Packet Filter)
The modern magic technology.
*   allows running sandboxed programs in the Linux Kernel without changing kernel source code.
*   **Cilium / Tetragon**: Uses eBPF to monitor network and process execution with near-zero performance overhead.
*   This is the future of Linux security.