s applied. Although iptables is the common way to do packet filtering, in the Envoy proxy case, the longer datapath amplifies the bottleneck of packet filtering process in the kernel.</p><p>If we use <code>sockops</code> to directly connect the sidecar’s socket to the application’s socket, the traffic will not need to go through iptables rules, and thus performance can be improved.</p><h3 id=processing-outbound-traffic>Processing outbound traffic</h3><p>As mentioned above, we would like to use eBPF’s 