More of a @brauner question. I wonder if that particular netfilter plugin is simply not aware of cgroup namespacing maybe?