Try this method of using an OCI runtime hook for tracing syscalls before you build a container.
Complete Story