@Zweasta maybe this will help https://github.com/osquery/osquery/pull/6414#issuecomment-630190327

@Mike Myers This helps me to find the packages associated with containers, but I am looking for mapping the process name of container to a package name. Is there a way to do that ?

Sorry, I don't know. Maybe there is a way to do it with a

JOIN

Okay, will try if there is a possibility. Thanks for the info!