Falco is a cloud-native runtime security daemon that monitors Linux system calls, Kubernetes audit logs, and plugin-supplied events in real time. It applies a flexible rule engine to detect anomalous behavior and generates alerts via multiple output channels (stdout, file, syslog, HTTP, program). The codebase is a monolithic C++ application with a modular internal architecture: a sequenced action pipeline (app/app.cpp) drives startup, configuration, plugin loading, rule compilation, event processing, and output dispatch. The rule engine (userspace/engine/) parses YAML rule definitions, resolves macros and filters, indexes rules by event type, and matches events efficiently. The output subsystem uses a thread-safe worker queue with a watchdog. Falco supports hot-reload via inotify file watching and a Unix socket control endpoint. It is deployed as a Helm chart on Kubernetes (DaemonSet/Deployment) and is packaged as DEB, RPM, and Docker images. The repository includes extensive unit tests (Google Test), end-to-end event generator tests, and CI/CD pipelines for building, testing, and publishing. External dependencies include falcosecurity/libs (sinsp), falcoctl, OpenSSL, cURL, yaml-cpp, and jemalloc. The architecture demonstrates strong engineering practices with clean abstractions (indexed_vector, atomic_signal_handler, yaml_helper) and composable action steps.
Microcks is a cloud-native API mocking and testing platform that ingests API specifications (OpenAPI, AsyncAPI, gRPC, GraphQL, Postman, SoapUI, HAR, and protobuf) and dynamically generates live mock endpoints and contract conformance tests. It supports REST, SOAP, GraphQL, gRPC, and asynchronous protocols (Kafka, RabbitMQ, MQTT, NATS, WebSocket, Amazon SQS/SNS, Google PubSub). The architecture consists of a main Spring Boot web application with an Angular frontend, a separate Quarkus-based async minion for event-driven mocking and testing, and optional dependencies on MongoDB, Keycloak, Kafka, and external message brokers. The system provides a rich set of features: dynamic response dispatching based on request parameters, scriptable mocks (Groovy/JavaScript), a template engine for dynamic content, SLA management, webhook notifications, AI-assisted sample generation via OpenAI, and OpenTelemetry-based observability. It is a well-engineered, modular project with extensive test coverage and a clean separation of concerns.
Harbor is an open-source, cloud-native container registry platform for managing OCI/Docker images, Helm charts, and other artifacts. It provides a full-stack solution with a Go backend, Angular web portal, PostgreSQL database, and Redis/ValKey job queue. The system supports artifact storage, vulnerability scanning (Trivy integration), SBOM generation, multi-registry replication (Docker Hub, Quay, JFrog, cloud CRs), tag retention policies, immutable tags, RBAC with LDAP/OIDC, robot accounts, webhook/notification pipelines, P2P preheat, and audit logging. The architecture follows a layered pattern: REST API handlers (v2.0) → controllers → managers → DAOs, with middleware chains for security, quota, and content trust. Key entry points include the core API server, job service for background tasks, registry controller for blob/manifest management, and the Angular portal for administration. External dependencies include PostgreSQL, Redis, Trivy scanner, and various cloud registry APIs. The codebase is well-structured with extensive unit and integration tests, though it exhibits some technical debt from generated mocks and legacy components.