Hi Xu,
Yeah, these are similar to the ideas I heard via Lantao. My thought behind the issue I created was to try and find a solution that is generic enough to be built mostly into the containerd CRI plugin. But it may be that adding port-forward to the shim API and having shim implementations be fully responsible for port-forwarding might be easier. I'm curious what you think.
BTW, for your solution 1, where would socat come from and how would it be executed? Would that be in a container? Or would the kata shim do it similarly to how containerd used to do it and run the socat found on the Kata guest VM but inside the Pod ns (i.e. outside Pod cgroup)?