Can we not also somehow verify that there's a command running inside the container, too?  This seems to me to have a high potential for getting out of sync.