querying the em socket for a

osqueryd

process running in one container, from another container, does return (for my limited purposes at least) results consistent with the osqueryd process, including for the

file_events

table.