Most workloads are cloud-native these days so a k8s/docker rootkit would make a lot more sense.