docker host 可以拦截容器内的本地流量吗？

Question

Is it possible for the docker host to observe the communication between two processes running inside the same container? The processes use TCP on localhost for communication.

Most of the documentation I see talk about sniffing on the docker0 interface or any interface created by docker-compose. But this would be outbound/inbound traffic on the network interface. In my case all communication is local.

Answer 1

I used bpftrace with tcpconnect.bt (or tcpaccept.bt) as you can see it can observe container localhost to container localhost tcp connect (or accept)

if you want to more detail, you could write your own bpf program