I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security dilemma that I would like some thoughts and feedback on:
Running osquery on every Docker container in the infrastructure would give excellent situational awareness, but unfortunately osquery can't run on the slimmed-down, security-focused Alpine Linux distro, which means that the entire fleet of Docker containers would need to be based on much more bloated images like Debian or Ubuntu with a much larger attack surface and possibilities for an attacker, if they gain access to a container.
Is it common practice to put osquery on containers, or should they simply be treated as dumb cattle with minimal attack surface which can be shot if showing signs of weirdness, and then have advanced monitoring on the Docker host machines instead?