Every Docker container has a diff dir on the host at /var/lib/docker/overlay2/<id>/diff/ containing every file it's changed since starting. DriftSense reads that directory from the host with no container intrusion, no privilege escalation inside the image, no networking dance.

Pair that with the Docker socket for name mapping and you get complete change visibility across a containerized fleet from a single privileged process on the host. Enable in Settings → Docker awareness.