osquery listening_ports listening different from 'ss'

Bug report

What operating system and version are you using?

version = 12 (bookworm)
   build =
platform = debian

What version of osquery are you using?

version = 5.14.1

What steps did you take to reproduce the issue?

sudo apt install atop
sudo docker network create network1
sudo docker run -d --network network1 -v "$(pwd)/assets/:/www/assets" -e INIT_ASSETS=1 -p 8080 b4bz/homer
sudo osqueryi "SELECT DISTINCT processes.name, listening_ports.port, processes.pid FROM listening_ports JOIN processes USING (pid) WHERE listening_ports.address = '0.0.0.0';
sudo ss -tulpn

What did you expect to see?

Output of osquery and ss command to match

What did you see instead?

TLDR: I tried osquery 5.14.1 on my Debian 12 server and want to check for public listening ports, and the result differs from the 'ss -tulpn' command. osquery lists incorrect entries.

1. I run a Docker container which runs lighttpd. It only listens internally within the Docker engine, using the "expose" keyword instead of "ports", which means it can only be reached from another Docker container. And yet, osquery lists it among public listening processes.

2. it shows atop, a local system service I run, which I don't think is even network-aware. Might be using local sockets.

$ sudo osqueryi "SELECT DISTINCT processes.name, listening_ports.port, processes.pid
  FROM listening_ports JOIN processes USING (pid)
  WHERE listening_ports.address = '0.0.0.0';"
+--------------+------+---------+
| name         | port | pid     |
+--------------+------+---------+
| sshd         | 22   | 470     |
| docker-proxy | 80   | 9845    |
| docker-proxy | 443  | 9853    |
| atop         | 255  | 1652187 |
| nginx        | 80   | 29502   |
| nginx        | 443  | 29502   |
| lighttpd     | 8080 | 6211    |
+--------------+------+---------+

The host's 'ss' command doesn't show lighttpd or atop, which is the correct behavior:

$ sudo ss -tulpn
Netid      State       Recv-Q      Send-Q           Local Address:Port           Peer Address:Port     Process
tcp        LISTEN      0           128                    0.0.0.0:22                  0.0.0.0:*         users:(("sshd",pid=470,fd=3))
tcp        LISTEN      0           4096                   0.0.0.0:80                  0.0.0.0:*         users:(("docker-proxy",pid=9845,fd=4))
tcp        LISTEN      0           4096                   0.0.0.0:443                 0.0.0.0:*         users:(("docker-proxy",pid=9853,fd=4))
tcp        LISTEN      0           128                       [::]:22                     [::]:*         users:(("sshd",pid=470,fd=4))

Full contents of listening_ports:

$ sudo osqueryi "SELECT pid,port,protocol,address,socket,path from listening_ports WHERE port != 0 ORDER BY port;"
+---------+-------+----------+------------+----------+------+
| pid     | port  | protocol | address    | socket   | path |
+---------+-------+----------+------------+----------+------+
| 470     | 22    | 6        | 0.0.0.0    | 14825    |      |
| 470     | 22    | 6        | ::         | 14836    |      |
| 9845    | 80    | 6        | 0.0.0.0    | 68481    |      |
| 29502   | 80    | 6        | 0.0.0.0    | 69359    |      |
| 1652187 | 255   | 255      | 0.0.0.0    | 12786578 |      |
| 9853    | 443   | 6        | 0.0.0.0    | 68488    |      |
| 29502   | 443   | 6        | 0.0.0.0    | 69360    |      |
| 29502   | 443   | 6        | ::         | 69361    |      |
| 6211    | 8080  | 6        | 0.0.0.0    | 61653    |      |
| 6211    | 8080  | 6        | ::         | 61652    |      |
| 1584839 | 9000  | 6        | 127.0.0.1  | 12206864 |      |
| 505     | 35545 | 6        | 127.0.0.11 | 68989    |      |
| 505     | 41074 | 17       | 127.0.0.11 | 68988    |      |
| 505     | 46439 | 6        | 127.0.0.11 | 61579    |      |
| 505     | 53529 | 17       | 127.0.0.11 | 61578    |      |
+---------+-------+----------+------------+----------+------+

Reproduce the Debian 12 report with the supplied listening_ports queries, Docker setup, and ss -tulpn comparison. Trace how the listening_ports table identifies sockets and associates them with processes, focusing on the atop and lighttpd entries. Done means the table's public-listener results match the host's ss output without losing valid listeners.