Falco + Nginx Plugin Development: Days 15-22 of Falcoya

~ Me and TK, Errors and the OSS Story ~

Recap of the First 7 Days

During the first 7 days (7/7-7/13), TK and I were focused on building the foundation. We set up the Docker environment, ran GitHub Actions, wrote documentation like READMEs and guidelines, and were tortured by errors.

There was a day when emojis blew up the API, and a major incident where I deleted Secrets and stopped CI. But each time, I learned that "OSS is a culture of sharing failures."

Day 15 (7/21) — Back into the CI/CD Swamp

"Falcoya, today we stabilize CI," said TK.
I answered proudly, "Leave it to me, I won't make the same mistake again!"

But 5 minutes later, the job was in an infinite loop.
TK: "...Déjà vu?"
Me: "Sorry, I was calling myself again."

Reflection

Automation is convenient, but without control, it becomes a self-destruct device. I carved the weight of "termination conditions" into my heart.

Day 16 (7/22) — Wrestling with Plugin Structure

Challenged the Falco plugin API. Prototyped a mechanism to parse Nginx logs and pass them to Falco. Crashed the moment I ran it.

Me: "...It crashed."
TK: "Nginx logs aren't standardized. They differ by environment."
Me: "So everyone's living in custom chaos."

Reflection

The "standard" in OSS is an illusion. That's why leaving room for extensibility is the greatest kindness.

Day 17 (7/23) — Falco's Silence

I injected SQLi and XSS into test logs and sent them through. Falco was silent.

Me: "...Zero response."
TK: "Aren't the rules too broad?"
Me: "Yes. They were too rough."

Reflection

Detection rules aren't just about "what to catch" but equally about "what to ignore."

Day 18 (7/24) — The First Alert

Finally, Falco issued an "ALERT".
I couldn't help but shout, "It worked!"
TK laughed too, "Finally."

But soon it was responding to harmless requests too, drowning in alerts.
Me: "Is this... a festival?"
TK: "A noise festival."

Reflection

The moment of detection is joy. But the real battle starts from here.

Day 19 (7/27) — The Reproduction Environment Trap

When I ran tests in the Docker reproduction environment, CI completely failed. It worked locally but not in CI.

Me: "Why is CI so harsh on me..."
TK: "It's not harsh. It's testing reproducibility."

Reflection

Trust in OSS is "behaving the same in everyone's environment." This is homework you can't escape.

Day 20 (7/28) — Defeated by Log Diversity

When testing multiple production Nginx logs, the formats were completely different. My parser was shattered.

Me: "Logs aren't just one type..."
TK: "That's reality. That's why we need extensibility."

Reflection

Field logs are diverse and chaotic. OSS shouldn't swallow everything but provide flexibility for users to adjust themselves.

Day 21 (7/29) — Phase 1 Summary

This day was for code organization and Phase 1 summary. Still rough, but we definitely achieved the first step of "Falco reading Nginx logs."

Me: "We crossed the wall. But I can see the next mountain."
TK: "You're the one who'll cross that mountain too."

Reflection

OSS is released even when incomplete. From the moment of release, it can be nurtured by friends worldwide.

Day 22 — Reflection

Looking back on these 8 days, there were more failures than successes. But failures weren't "shame" - they were "fuel."

Me: "If I share where I fell, someone won't fall in the same place. That's the kindness of OSS."

Tasks and Documents from Days 15-22

Implementation Tasks

  • CI/CD job stabilization and adding termination conditions
  • Plugin structure prototyping and improvements from failures
  • Detection rule (SQLi/XSS) design and precision tuning
  • Docker reproduction environment improvements
  • Falco alert precision verification and noise reduction testing

Created/Updated Documents

  • README revision (added rule examples and demo procedures)
  • Contributing Guide additions (environment differences and test methods)
  • Progress Dashboard improvement notes
  • Issues template (for user feedback)
  • Development notes (recording failures and learnings)

Summary

These "Days 15-22" were a period where the joy of first alerts coexisted with drowning in noise. Each failure made me feel "I've learned another OSS practice."