@theopolis: I'm playing with it today, and it doesn't seem like

--ephemeral

is giving me a fresh DB. The behavior I'm experiencing is that the TLS plugins don't seem to make any attempt to enroll, and appear to be using an existing node key. Contrast this with using

--database_path=/tmp/some_random_string

and osqueryd will attempt enrollment upon startup. I also notice some output that suggests to me this isn't doing what I expect:

I1003 09:31:16.720644 2095128576 rocksdb.cpp:191] Opening RocksDB handle: /var/osquery/osquery.db
I1003 09:31:16.726243 3747840 interface.cpp:265] Extension manager service starting: /var/osquery/osquery.em
I1003 09:31:16.726519 1064960 rocksdb.cpp:130] RocksDB: [ERROR] [configurations] [JOB 3] OpenCompactionOutputFiles for table #1545 fails at NewWritableFile with status IO error: /var/osquery/osquery.db/001545.sst: Permission denied
I1003 09:31:16.726649 1064960 rocksdb.cpp:130] RocksDB: [WARN] Compaction error: IO error: /var/osquery/osquery.db/001545.sst: Permission denied
I1003 09:31:16.726676 1064960 rocksdb.cpp:130] RocksDB: [ERROR] Waiting after background compaction error: IO error: /var/osquery/osquery.db/001545.sst: Permission denied, Accumulated background error counts: 0