Is it not sufficient to run a query schedule on the

osqueryd

running in the container, and somehow expose the logs outside the container?