<p>I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS - before taking this to EKS I want to test it locally.</p>
<p>I am using the standard Helm chart:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl create ns falco
helm upgrade --install falco \
  --set falco.jsonOutput=true --set auditLog.enabled=true \
  --set image.repository=falcosecurity/falco-no-driver \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.openfaas.functionname=&quot;falco-pod-delete&quot; \
  --namespace falco \
  falcosecurity/falco
</code></pre>
<p>The issue occurs as the falco-driver-load InitContainer is unable to download the driver fom my OS (from <a href="https://download.falco.org/?prefix=driver/2.0.0%2Bdriver/x86_64/" rel="nofollow noreferrer">here</a>, so it tries to build the driver and fails.</p>
<pre class="lang-bash prettyprint-override"><code>* Looking for a falco module locally (kernel 5.17.5-76051705-generic)
* Trying to download a prebuilt falco module from https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_pop_5.17.5-76051705-generic_202204271406.ko
curl: (22) The requested URL returned error: 404 
Unable to find a prebuilt falco module
* Trying to dkms install falco module with GCC /usr/bin/gcc
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
  You are using:           gcc (Debian 5.5.0-12) 5.5.0 20171010
  CC [M]  /var/lib/dkms/falco/2.0.0+driver/build/main.o
gcc: error: unrecognized command line option '-mharden-sls=all'
gcc: error: unrecognized command line option '-Wimplicit-fallthrough=5'
make[2]: *** [scripts/Makefile.build:288: /var/lib/dkms/falco/2.0.0+driver/build/main.o] Error 1
</code></pre>
<p>I was wondering if I would be able to use the Ubuntu driver, and if so how can I override this?</p>

<p>I needed to install the kernel headers for my system, as well as increase some fx.inotify sysctl parameters.</p>
