@groob Since the concept of "container" in Linux is an abstract one it doesn't really run inside the container. Also, this is the same osquery code, just a different process. It enters into the mnt namespace of the container, but doesn't inherit it's cgroups or other namespaces like pid, network, etc