@movq@www.uninformativ.de Yeah I immediately thought of this when you asked, because we use eBPF-based tools in Kubernetes clusters. It’s very powerful stuff and you can do a lot very cheaply with it, including tying packets to processes.