[zokier]

At least conceptually I think the same approach, using ebpf to capture traffic, should work pretty much the same with or without containers. So it could be fairly minor adjustment to get it working outside containers too?