This is great, I was already doing research in that area for my tool. What about a container that writes to the /etc/hosts? It won’t emit DNS queries at all and because of that the connections will show up as bare IPs without domain. That’s a known trick, already exploited (collusion.wiki mentioned here on HN two days ago)

Good point. Yeah, there will not be a DNS name mapping for such an IP. TBF, that's also gonna be the case if there is a hardcoded IP inside the container. With that said, the actual network connection(w/o the DNS name resolution) will still show up here because ultimately it has to open a socket if/when it connects. It will still give you that attributed to the container in dsnitch for further analysis.