Currently the socket tracker uses the container PID/TID to map recent connections to a certain container. This has some flaws:
- if the socket is created by a nested process of 2 layers deep it will not be tracked.
- some workarounds were required to make this work for local kind clusters (local testing and e2e tests) as the kind "host" PIDs don't match the actual host PIDs.
One way to improve this would be to use the Pod IP+container port pair to track connections. This should generally be more reliable as it's stable during the lifetime of a Pod, unlike the PID which changes every time the container is checkpointed/restored.