Indeed, that's kinda teh big question. I prefer containers to be as small as possible. but then how do you get that insight into them? Do you trust in your seccomp profile to be perfect? do you just run on teh host and let osquery run there? so many questions!