containerized osquery is cool. In the context of something like kubernetes or CoreOS, you can run osquery in a container with https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/ Some tables work as you'd expect, but others will give you data for the container osqueryd is running in, not the host.