my confusion was that running

osqueryi

in the container running

osqueryd

has no real interaction with the

osqueryd

process and, depending on how flags and config are set up, might just be expected to have different behavior, and generally isn't a reliable way to ask about how the

osqueryd

process behaves or what it knows or what it can see etc etc.