Catching up again, I think I follow your approach now. But fork() of osquery for every container running on the host might a big hammer! Not sure what it means in terms of resource utilization!