How the sidecar steals the traffic

How a sidecar proxy intercepts a pod's traffic without the app knowing: iptables REDIRECT, conntrack, SO_ORIGINAL_DST, and the infinite loop that UID 1337 fixes.