running osqueryd in a container makes less sense than running on hosts except that there's less and less environments where anything is run on VMs/hosts directly. We use k8s everywhere and the host itself is ChromeOS. I've never SSH'd into one