@cburr if you need to monitor processes in containers you can use sysdig falco (on Linux anyway), but I agree it would be great to have this functionality in osquery