Process events depends on audit/netlink functionality, which from my experience (https://github.com/osquery/osquery/issues/6121) shows you need uid=0. You will need to ensure the container is running as root, and you may also need to mounth some paths such as the host's

/proc

if you intend on monitoring process events for the whole system