@cburr I don't think that you could do that with osquery as of now, however with the proliferation of containers it seems worth some effort to improve our capabilities.