Hi Andrew
This solved the issue!
I can now see auditd logs coming in and also add my own auditd config file to my docker container, doing more auditing that just set by the host.
May I ask how this relates to my problem and also what network modes are applicable? (Bridge etc.)
So that I don't do the same mistake again.