we do a LOT with LXC and run

osqueryd

on the 'host', not in the containers. I will bind mount some directories and provide a path in the default profile so folks debugging within the container can use

osqueryi

if they'd like