the biggest issue so far is that tracing API (audit, BPF) report the PID inside the namespace

Hey @alessandrogario, thanks for the insight here. How do you currently have osquery deployed to monitor the container? Is it deployed as a host package? Or containerized as well?