One host, check the contents of /proc/net/sockstat:
cat /proc/net/sockstat
sockets: used 245
TCP: inuse 6 orphan 4 tw 1 alloc 2696 mem 95
UDP: inuse 4 mem 10
UDP: inuse 4 mem 10
RAW: inuse 0
FRAG: inuse 0 memory 0
But check it in the containers:
cat /proc/net/sockstat
sockets: used 886
TCP: inuse 3 orphan 2 tw 49 alloc 2699 mem 105
UDP: inuse 1 mem 10
UDP: inuse 1 mem 10
RAW: inuse 0
FRAG: inuse 0 memory 0
The number of used sockets seen in the host is too low to match the actual number (lots of tcp allocated in the container). Why?