⚡ Bolt: Optimize TCP retransmit handling in Registry event loop

.jules/bolt.md

@@ -0,0 +1,3 @@
+## 2024-05-21 - Registry Event Loop Optimization
+**Learning:** The `handleEvents` loop in `Registry` naively iterated all containers for every `TCPRetransmit` event, causing high CPU/allocations under network stress.
+**Action:** Implemented PID-based fast path lookup and slice reuse to optimize the hot path.

containers/registry.go

@@ -168,6 +168,7 @@ func (r *Registry) Close() {
 func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
 	gcTicker := time.NewTicker(gcInterval)
 	defer gcTicker.Stop()
+	var containerCache []*Container
 	for {
 		select {
 		case now := <-gcTicker.C:
@@ -357,15 +358,30 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
 					c.onConnectionClose(e)
 				}
 			case ebpftracer.EventTypeTCPRetransmit:
-				r.containerLock.RLock()
-				containers := make([]*Container, 0, len(r.containersById))
-				for _, c := range r.containersById {
-					containers = append(containers, c)
+				handled := false
+				if e.Pid != 0 {
+					r.containerLock.RLock()
+					c := r.containersByPid[e.Pid]
+					r.containerLock.RUnlock()
+					if c != nil && c.onRetransmission(e.SrcAddr, e.DstAddr) {
+						handled = true
+					}
 				}
-				r.containerLock.RUnlock()
-				for _, c := range containers {
-					if c.onRetransmission(e.SrcAddr, e.DstAddr) {
-						break
+				if !handled {
+					r.containerLock.RLock()
+					if cap(containerCache) < len(r.containersById) {
+						containerCache = make([]*Container, 0, len(r.containersById))
+					} else {
+						containerCache = containerCache[:0]
+					}
+					for _, c := range r.containersById {
+						containerCache = append(containerCache, c)
+					}
+					r.containerLock.RUnlock()
+					for _, c := range containerCache {
+						if c.onRetransmission(e.SrcAddr, e.DstAddr) {
+							break
+						}
 					}
 				}
 			case ebpftracer.EventTypeL7Request: