Abstract: The present disclosure provides effective solutions to security inspection and monitoring of operations within security containers. The solutions overcome the challenges and difficulties caused by the isolation of the containers. One embodiment relates a computer-implemented method in which a security agent is migrated between one or more containers and the host machine by changing its namespace. Another embodiment relates to a computer-implemented method for user-mode object monitoring of one or more containers in which a security agent migrates serially to multiple containers while keeping user-mode object-monitoring handles for the containers. Thereafter, the security agent may migrate into the host machine and continue monitoring events within the containers using the user-mode object-monitoring handles. Another embodiment relates to a host machine which includes a master agent that communicates with multiple security agents holding user-mode object-monitoring handles for corresponding containers.