diff --git a/schema/fleet_schema.json b/schema/fleet_schema.json
index 1c431cf3d3..efef154e52 100644
--- a/schema/fleet_schema.json
+++ b/schema/fleet_schema.json
@@ -167,6 +167,26 @@
     "name": "disk_events",
     "examples": "This is an evented table, and as such, is more useful if you are sending osquery logs to a SIEM or other centralized destination via Fleet. Events must be enabled. This query will contain the list of all actions related to connecting and removing disks, including SMB drives and USB storage, which can be very useful for investigative purposes.\n```\nSELECT * FROM disk_events;\n```"
   },
+  {
+    "name": "docker_container_envs",
+    "examples": "This table allows you to list environment variables for running Docker containers. This query will output the value of a variable called *MYSQL_VERSION* for example.\n```\nSELECT key, value FROM docker_container_envs WHERE key LIKE 'MYSQL_VERSION';\n```"
+  },
+  {
+    "name": "docker_container_labels",
+    "examples": "This table exposes all Docker labels on running containers. By joining it to the [docker_containers](https://fleetdm.com/tables/docker_containers)table, we can list containers and their maintainers.\n```\nSELECT dl.value, dc.name, FROM docker_container_labels dl JOIN docker_containers dc ON dl.id = dc.id WHERE key='maintainer';\n```"
+  },
+  {
+    "name": "docker_container_mounts",
+    "examples": "List the source and destination of Docker bind and volume mounts.\n```\nSELECT dm.source, dm.destination, dm.mode, dc.name FROM docker_container_mounts dm JOIN docker_containers dc ON dm.id = dc.id;\n```"
+  },
+  {
+    "name": "docker_container_networks",
+    "examples": "List the IP address of Docker containers.\n```\nSELECT dn.ip_address, dc.name FROM docker_container_networks dn JOIN docker_containers dc ON dn.id=dc.id;\n```"
+  },
+  {
+    "name": "docker_container_ports",
+    "examples": "Identify the ports exposed at the host level and see which containers they redirect traffic to.\n```\nSELECT dc.name, dp.type, dp.port, dp.host_ip, dp.host_port FROM docker_container_ports dp JOIN docker_containers dc ON dp.id=dc.id WHERE dp.host_port !='0';\n```"
+  },
   {
     "name": "event_taps",
     "examples": "Identify processes that have a tap into the system, such as access to keystrokes, and view details on the executable including signature status, team identifier if signed and the authority that emitted the signing certificate. This can be used to detect keyloggers and other malicious applications.\n```\nSELECT t.event_tapped, s.identifier, s.signed, s.team_identifier, s.authority FROM event_taps t JOIN processes p ON p.pid = t.tapping_process JOIN signature s on s.path = p.path WHERE s.identifier !='com.apple.ViewBridgeAuxiliary' AND s.identifier !='com.apple.universalaccessd' AND s.identifier !='com.apple.accessibility.AXVisualSupportAgent';\n```"
@@ -649,7 +669,7 @@
   },
   {
     "name": "crontab",
-    "examples": "List commands scheduled for execution as cron jobs\n```\nSELECT * FROM crontab;\n```",
+    "examples": "List commands scheduled for execution as cron jobs.\n```\nSELECT * FROM crontab;\n```",
     "columns": [
       {
         "name": "pid_with_namespace",
@@ -669,6 +689,7 @@
   },
   {
     "name": "docker_containers",
+    "examples": "Identify containers that are running with high privileges.\n```\nSELECT state, status, image, image_id FROM docker_containers WHERE privileged='1';\n```",
     "columns": [
       {
         "name": "cgroup_namespace",