$ getenforce
Enforcing
$ docker inspect execsnoop | jq '.[] | .Path'
"/usr/share/bcc/tools/execsnoop"
$ docker inspect execsnoop | jq '.[] | .Args'
[
  "-n",
  "docker",
  "-l",
  "ps"
]
$ docker logs execsnoop
bpf: Failed to load program: Invalid argument
Unrecognized arg#0 type PTR
; int syscall__execve(struct pt_regs *ctx)
0: (bf) r6 = r1
; struct pt_regs * __ctx = ctx->di;
1: (79) r7 = *(u64 *)(r6 +112)
; const char __user *filename; bpf_probe_read(&filename, sizeof(filename), &__ctx->di);
2: (bf) r3 = r7
3: (07) r3 += 112
4: (bf) r1 = r10
;
5: (07) r1 += -16
; const char __user *filename; bpf_probe_read(&filename, sizeof(filename), &__ctx->di);
6: (b7) r2 = 8
7: (85) call bpf_probe_read#4
unknown func bpf_probe_read#4
processed 8 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

Traceback (most recent call last):
  File "/usr/share/bcc/tools/execsnoop", line 229, in <module>
    b.attach_kprobe(event=execve_fnname, fn_name="syscall__execve")
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 829, in attach_kprobe
    fn = self.load_func(fn_name, BPF.KPROBE)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 528, in load_func
    (func_name, errstr))
Exception: Failed to load BPF program syscall__execve: Invalid argument
$ docker inspect execsnoop | jq '.[] | .Mounts'
[
  {
    "Type": "bind",
    "Source": "/sys/fs/cgroup",
    "Destination": "/sys/fs/cgroup",
    "Mode": "",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/sys/fs/bpf",
    "Destination": "/sys/fs/bpf",
    "Mode": "",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/lib/modules",
    "Destination": "/lib/modules",
    "Mode": "",
    "RW": true,
    "Propagation": "rprivate"
  },
  {
    "Type": "bind",
    "Source": "/sys/kernel/debug",
    "Destination": "/sys/kernel/debug",
    "Mode": "",
    "RW": true,
    "Propagation": "rprivate"
  }
]