Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
docker_container_processes
docker_container_processes
Docker container processes.
| Column | Type | Description |
|---|---|---|
| cmdline | text | Complete argv |
| cpu | double | CPU utilization as percentage |
| egid | bigint | Effective group ID |
| euid | bigint | Effective user ID |
| gid | bigint | Group ID |
| id | text | Container ID Required in WHERE clause |
| mem | double | Memory utilization as percentage |
| name | text | The process path or shorthand argv[0] |
| nice | integer | Process nice level (-20 to 20, default 0) |
| parent | bigint | Process parent's PID |
| pgroup | bigint | Process group |
| pid | bigint | Process ID |
| resident_size | bigint | Bytes of private memory used by process |
| sgid | bigint | Saved group ID |
| start_time | bigint | Process start in seconds since boot (non-sleeping) |
| state | text | Process state |
| suid | bigint | Saved user ID |
| threads | integer | Number of threads used by process |
| time | text | Cumulative CPU time. [DD-]HH:MM:SS format |
| total_size | bigint | Total virtual memory size |
| uid | bigint | User ID |
| user | text | User name |
| wired_size | bigint | Bytes of unpageable memory used by process |
Example
select * from docker_container_processes where id = '11b2399e1426d906e62a0c357650e363426d6c56dbe2f35cbaa9b452250e3355'
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
