go-ebpf-proxy is a sidecar that transparently redirects an unmodified application's outbound IPv4 TCP egress using eBPF (cgroup/connect4, no iptables) to a pass-through L4 relay, and passively extracts the app's TLS session keys via an LD_PRELOAD interposer that registers OpenSSL's own keylog callback — producing NSS-format keylogs so the captured (still end-to-end encrypted) TLS 1.2/1.3 traffic can be decrypted and inspected offline. No TLS termination, no MITM CA.
Developers and security engineers need to inspect the plaintext of an application's encrypted egress without modifying the application, without iptables (blocked by policy/missing modules), and without a MITM CA (defeated by certificate pinning and weakening the app's trust), including TLS 1.3 flows that forward secrecy makes impossible to decrypt with static keys.
curl <https://example.com> in the app container succeeds end-to-end through the relay (validating the real server certificate, no -k); the resolved original destination matches; and the captured pcap decrypts to plaintext HTTP using the preload-interposer-emitted NSS keylog.
cgroup/connect4 transparent redirection (no iptables) to a pass-through L4 relay (raw byte pipe, used as a single capture choke point) + passive TLS key extraction via an LD_PRELOAD interposer on the app's TLS library, emitting an NSS keylog. The connect4/sockops programs attach at the pod common parent cgroup; loop avoidance comes from the sidecar's UID-1337 exclusion. No TLS termination, no MITM CA, no sockmap in the MVP.connect4 stores original dst by socket cookie; a sockops (TCP_CONNECT_CB) program re-keys it by source tuple; the Go proxy resolves the original destination via getpeername() + map lookup. Never rely on SO_COOKIE/SO_ORIGINAL_DST on the accepted socket.IPPROTO_TCP, IPv4, non-loopback destinations; skip the proxy's own UID (1337) to avoid loops — load-bearing, since the pod-parent attach also scopes the sidecar, whose container therefore runs entirely as UID 1337.net,ipc,uts namespaces and host cgroup namespace (--cgroupns=host) so the programs can attach at the pod common parent cgroup; the sidecar container runs entirely as UID 1337 (loop exclusion); sidecar caps after --cap-drop ALL: CAP_BPF + CAP_NET_ADMIN (redirect) + CAP_SYS_RESOURCE (BPF memlock) + CAP_NET_RAW (capture socket); the app container is launched with LD_PRELOAD=<interposer.so> for TLS key extraction (no shared PID namespace, no CAP_PERFMON — both were uprobe-attach-only and are no longer needed); kernel ≥ 5.10; mounts /sys/fs/bpf, /sys/fs/cgroup.04-platform-support feature. (Production Kubernetes itself remains an MVP non-goal — see below.)connect6); UDP/QUIC/HTTP-3; production Kubernetes; live in-band DPI; TUI. (Certificate pinning is a non-issue: passive key extraction reads the app's own keys and never presents a forged certificate.)