Adding docker_container_fs_changes table

[scoders-tob]

This table lists changes to a container's filesystem since it's creation.

Example query:

osquery> select * from docker_container_fs_changes where id = '6d4a0ff6d954';
+--------------+----------+-------------+
| id           | path     | change_type |
+--------------+----------+-------------+
| 6d4a0ff6d954 | /bin     | C           |
| 6d4a0ff6d954 | /bin/xxx | A           |
| 6d4a0ff6d954 | /bin/tar | D           |
| 6d4a0ff6d954 | /xxx     | A           |
+--------------+----------+-------------+

change_type legend: C:Modified, A:Added, D:Deleted

[theopolis]

I think the toolchain/docker image needs to be updated before merging.

[scoders-tob]

Done!

[scoders-tob]

Hi @theopolis, request to merge this one please if you're okay with it.

[theopolis]

@Smjert or @alessandrogario can you merge this when you are ready. I don't want to be the one who merges due to the Azure image update coordination.

[Smjert]

@Smjert or @alessandrogario can you merge this when you are ready. I don't want to be the one who merges due to the Azure image update coordination.

You can go ahead with this, the Docker image name is correct, Sahil already did that, thanks!