when it comes to orchestration like k8s, dcos, etc., don't run osquery in a container. i can see this push coming from devops teams to suddenly treat all apps with the same brush. but the reality is that coreos and the like are choices of what binaries get shipped with it and which do not - notably absent are good os monitoring tools for security. these tools belong with the base.