Goal:

We should include a new property  —  is_docker = true/false —  to allow us to filter out the docker usage from our User definition (coalesce(auid, device_id)), and at least know the event volume and types for docker. 

Implementation details:

• Implement docker running recognition in the MCP server to know if it's bein ran via docker or set an env variable in the docker files that can be read later on.
• Add the property to all events