@diptanu 👍 I contributed docker tables to osquery. Unless I am missing something, using the docker API to exec (

docker exec

) should provide you with the information. Two problem I see are detecting type of image (debian, centos etc). to run the right command (dpkg, rpm etc) And parsing might be annoying!