Capture when a packet is created inside a container with netfilter

I am trying to capture when a packet is created inside a container. I have containerd using the runc runtime to actually run and create the containers.

I have a kernel module loaded in the host to capture packets using netfilter. Below is the configuration of the hook.

ipv4_local_out_hook->hooknum    = NF_INET_LOCAL_OUT;ipv4_local_out_hook->pf     = PF_INET;ipv4_local_out_hook->priority   = NF_IP_PRI_FIRST;

It works well for udp and tcp packets sent from the host, but doesn't capture anything created inside the containers.

To make it work, I have to set the hooknum to at leastNF_INET_FORWARD. The issue with this is that the socket struct is null in sk_buff. I would like to capture container packets as early as possible so that the socket struct is populated. How can I configure the netfilter hook to do this?