From 59a897a83ecd22d4959fc1aff6ebd0fac84dc957 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 3 Jan 2026 14:04:20 +0000
Subject: [PATCH] Optimize TCP retransmit handling in Registry event loop

Introduced a fast-path lookup by PID and slice reuse to avoid O(N) allocations for every retransmit event.
---
 .jules/bolt.md         |  3 +++
 containers/registry.go | 32 ++++++++++++++++++++++++--------
 2 files changed, 27 insertions(+), 8 deletions(-)
 create mode 100644 .jules/bolt.md

diff --git a/.jules/bolt.md b/.jules/bolt.md
new file mode 100644
index 00000000..c2fdf254
--- /dev/null
+++ b/.jules/bolt.md
@@ -0,0 +1,3 @@
+## 2024-05-21 - Registry Event Loop Optimization
+**Learning:** The `handleEvents` loop in `Registry` naively iterated all containers for every `TCPRetransmit` event, causing high CPU/allocations under network stress.
+**Action:** Implemented PID-based fast path lookup and slice reuse to optimize the hot path.
diff --git a/containers/registry.go b/containers/registry.go
index 4e41fad5..79599cb1 100644
--- a/containers/registry.go
+++ b/containers/registry.go
@@ -168,6 +168,7 @@ func (r *Registry) Close() {
 func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
 	gcTicker := time.NewTicker(gcInterval)
 	defer gcTicker.Stop()
+	var containerCache []*Container
 	for {
 		select {
 		case now := <-gcTicker.C:
@@ -357,15 +358,30 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
 					c.onConnectionClose(e)
 				}
 			case ebpftracer.EventTypeTCPRetransmit:
-				r.containerLock.RLock()
-				containers := make([]*Container, 0, len(r.containersById))
-				for _, c := range r.containersById {
-					containers = append(containers, c)
+				handled := false
+				if e.Pid != 0 {
+					r.containerLock.RLock()
+					c := r.containersByPid[e.Pid]
+					r.containerLock.RUnlock()
+					if c != nil && c.onRetransmission(e.SrcAddr, e.DstAddr) {
+						handled = true
+					}
 				}
-				r.containerLock.RUnlock()
-				for _, c := range containers {
-					if c.onRetransmission(e.SrcAddr, e.DstAddr) {
-						break
+				if !handled {
+					r.containerLock.RLock()
+					if cap(containerCache) < len(r.containersById) {
+						containerCache = make([]*Container, 0, len(r.containersById))
+					} else {
+						containerCache = containerCache[:0]
+					}
+					for _, c := range r.containersById {
+						containerCache = append(containerCache, c)
+					}
+					r.containerLock.RUnlock()
+					for _, c := range containerCache {
+						if c.onRetransmission(e.SrcAddr, e.DstAddr) {
+							break
+						}
 					}
 				}
 			case ebpftracer.EventTypeL7Request: