On Friday, March 10, 2017 11:47:06 PM EST Wajih Ul Hassan wrote: This is slowly being pulled together. This has to be done with common criteria (CC) certifications in mind since pci-dss, STIG, various contracting language all call out for or assume a common criteria certification. The first step in this direction was in pulling together a specification for container management events based on the virtualization protection profile. https://github.com/linux-audit/audit-documentation/wiki/SPEC-Virtualizati... The next step is to define what a container is and the use cases. From that we can advance the specification for auditing as it relates to containers. We will be digging into this soon. We can't really press forward without understanding all the certification requirements and this may even take some committee work to iron out the CC requirements. I'd hate to do something and then find out it doesn't meet requirements and undo and redo how it works. That would be too much disruption for utilities that might process the information. So, I think the answer for right now is you have to use labels. But this will get addressed in the coming months. -Steve