How Netflix Accurately Attributes eBPF Flow Logs

Is it necessary to rely on ip address attribution? If FlowExporter uses ebpf and tcp tracepoints, could each workloads be placed in its own cgroup and could FlowExporter directly introspect which cgroup (and thus, workload) a given tcp socket event should be attributed to?

That may help identify the local IPs but not the remote IPs.