Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

containerd_containers

Information about containerd containers.

Column	Type	Description
command	text	Command used to start the container.
created	integer	Unix timestamp of when the container was created.
id	text	Container ID.
image	text	Image name.
image_digest	text	Image digest (SHA256).
namespace	text	Namespace of the container.
pid	integer	PID of the container process.
runtime	text	Name of the container runtime (e.g. io.containerd.runc.v2).
state	text	Container state (e.g. running, stopped).

Example

Get all containers from all namespaces:

SELECT * FROM containerd_containers;

Get only running containers in the default namespace:

SELECT * FROM containerd_containers WHERE namespace='default' AND state='running';

Notes

This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).

The containerd table is available on Linux systems with containerd installed. It provides information about the containers managed by containerd, including their state, image, and runtime.

This table is useful for systems using containerd as a container runtime, such as those running Kubernetes. See the docker_containers table for information about containers managed by Docker.

Edit page