I've ported forward some code for containerd events. Most of the original code is from @Stefano Bonicatti but I can fix any issues: https://github.com/osquery/osquery/pull/7751