@matt a lot of queries execute in the user context of the user that started the osquery process. Just a shot in the dark, but are both containers running as the same user? Have you tried joining the query on uuid?