Saluki · January 25, 2019 14:22
diff --git a/container-osquery_users.sql b/container-osquery_users.sql
 -- See users who can access the Docker daemon
 SELECT u.username 
 FROM user_groups ug 
 LEFT JOIN users u ON u.uid=ug.uid  
 WHERE ug.gid IN (
  SELECT gid FROM groups WHERE groupname="docker"
 );
	-- See users who can access the Docker daemon
	SELECT u.username
	FROM user_groups ug
	LEFT JOIN users u ON u.uid=ug.uid
	WHERE ug.gid IN (
	SELECT gid FROM groups WHERE groupname="docker"
	);