Add an optional `kubernetes` feature (off by default, no extra dependencies)
that attributes connections to their owning pod and container on a node:
- cgroup parser maps a PID to pod UID + container ID via /proc/<pid>/cgroup
- cross-namespace socket-table walker reads per-PID /proc/<pid>/net/{tcp,udp},
which is netns-aware, so pod-owned sockets are attributed under hostNetwork
- pod/container names resolved from the kubelet log directories
(/var/log/containers, /var/log/pods): runtime-agnostic, no CRI socket and no
kubelet auth
- surfaced in the TUI details pane, JSONL and PCAP exports, and the pod:, ns:,
container: filter keywords
- `--kubernetes <auto|on|off>` controls it at runtime; `auto` (the default)
enables only when running inside a pod, detected via KUBERNETES_SERVICE_HOST
- Landlock read access extended to the kubelet log dirs when enabled, so name
resolution keeps working under the sandbox
The container image is built with the feature enabled (CARGO_FEATURES build-arg);
native installs (cargo/brew/deb/rpm) leave it off and stay lean.
Marco Cadetg
531a5ad370