detecting-container-escape-with-falco-rules

Writes and tunes Falco rule syntax for container escape detection — conditions, macros, lists, priorities, and output fields — covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert.…