if err != nil {
		return nil, fmt.Errorf("error initializing hostside probe ipset: %w", err)
	}

	podNsMap := newPodNetnsCache(openNetnsInRoot(pconstants.HostMountsPath))
	ztunnelServer, err := newZtunnelServer(args.ServerSocket, podNsMap)
	if err != nil {
		return nil, fmt.Errorf("error initializing the ztunnel server: %w", err)
	}

	cfg := &iptables.Config{
		RestoreFormat: true,
		RedirectDNS:   args.DNSCapture,

	ztunClient *net.UnixConn
	ztunServer *ztunnelServer
} {
	// go uses @ instead of \0 for abstract unix sockets
	addr := fmt.Sprintf("@testaddr%d", ztunnelTestCounter.Add(1))
	ztun, err := newZtunnelServer(addr, pods)
	if err != nil {
		panic(err)
	}
	go ztun.Run(ctx)

	// now as a client connect confirm we and get snapshot
	resolvedAddr, err := net.ResolveUnixAddr("unixpacket", addr)
	if err != nil {

	// add pod goes to newest connection
	// delete pod goes to all connections
	conns *connMgr
	pods  PodNetnsCache
}

var _ ZtunnelServer = &ztunnelServer{}

func newZtunnelServer(addr string, pods PodNetnsCache) (*ztunnelServer, error) {
	if addr == "" {
		return nil, fmt.Errorf("addr cannot be empty")
	}

	resolvedAddr, err := net.ResolveUnixAddr("unixpacket", addr)
	if err != nil {