如何拦截来自 docker 容器的 UDP 流量？

Question

I've got a simple application in a Docker container that listens for and transmits UDP data. This data is unencrypted and can be broadcasted or directed at a specific IP address.

What I would like to do is set up automated testing for this application. That is, I'd have a test script send certain packets to the application and capture / verify the response. I'm looking for ways this packet-sniffing could be done in Docker. I'd heard about mtimproxy , but it looks like it only handles HTTP/S traffic (and my application would not respect the HTTP/S_PROXY environment variable anyway).

Ideally, this packet sniffing would be done outside the container. As much as possible, I'm trying to make the application's container as unaware of the testing as possible (so I would like to use --network="bridge" and expose the ports needed, just like how this container would be deployed operationally). The trick would be I wouldn't want any other network traffic hitting the container, just the traffic generated by the test script. Does anyone have any ideas?

Answer 1

For anyone else with this issue, I ended up putting my test script in another docker container and using docker-compose to start them both up with a private network connecting them. It seems to be working well so far (I'm able to send / receive from both without an issue). I'll update this answer if that changes.