Thanks for your feedback @lukastribus
Some part of this question was probably driven by my inner neat freak: keep conntrack for user sessions only and try to avoid using loopbacks to minimize the attack surface (so my customers don’t accidentally create configs using the agents as servers).
Plus my HAProxy is running in a container, so the chroot question can be somewhat relaxed in this case.
That said, I noticed that there are multiple directives that already accept various address families (like unix@, config docs section 2.9.1). One of them is “server”, supporting unix, abns or even sockpair. So, if the feature did not exist yet, my hope was that at least the code supporting the address families syntax might be lurking just around the corner with little effort to wire it up in agent-checks.
I’ll head over to GitHub, let’s see what comes of it.