Computer-implemented methods, media, and systems for providing container visibility and observability are disclosed. In one computer-implemented method, a host device connected to a cloud server detects a plurality of events comprising a first event, wherein the host device hosts a plurality of containers that generate the plurality of events. The host device identifies a first container identifier of the first event, checks a container tracking database to determine if the container tracking database includes the first container identifier. In response to determining that the container tracking database does not include the first container identifier, the host device creates a container start event indicating a start of a first container identified by the first container identifier, and sends the container start event to the cloud server for providing a container inventory that reflects statuses of the plurality of events and the plurality of containers in the host device.