Network filtering for control groups

Isn't that what nftables was supposed to do?

I see that nftables uses its own VM rather than eBPF, but the main objection to just using eBPF seemed to be simply that with eBPF you can only replace the entire program, not individual rules. It appears to me that this could be handled by treating the nftables VM as an intermediate language and employing a user-mode helper program to compile the rules down to eBPF whenever they change.

The same mechanism would presumably integrate well with this new infrastructure to attach an eBPF filter to a control group.