Docker Community Forums

Share and learn in the Docker community.

Enable Audit Support in Kernel

On a Mac machine, I have installed Ubuntu within a docker container.
In the container, I want to enable Linux Audit Reporter to collect data.
However, auditctl gives me the following error:

Error - audit support not in kernel
Cannot open netlink audit socket

I have enabled AUDIT_CONTROL and ran the container in privileged mode as well but could not get it to work.
Does anyone know if we are able to enable audit reporter for the container, and the procedure for that?