Process auditing in containers
I think there is a way to do this on docker:


  As of Docker 1.10 User Namespaces are supported directly by the docker daemon. This feature allows for the root user in a container to be mapped to a non uid-0 user outside the container, which can help to mitigate the risks of container breakout. This facility is available but not enabled by default.


You can map the root user inside docker container to specific user from the host machine (uid).