如何在 Docker 上安装 tshark？

Question

我想使用 Dockerfile 在 Docker for Mac 上的 ubuntu17.04 上安装 tshark。我正在使用 docker-compose

中apt install tshark，有如下提示。
尽管我输入了提示停止安装yes。

如何在 Dockerfile 中安装 tshark？

Dumpcap can be installed in a way that allows members of the "wireshark" system
group to capture packets. This is recommended over the alternative of running
Wireshark/Tshark directly as root, because less of the code will run with
elevated privileges.

For more detailed information please see
/usr/share/doc/wireshark-common/README.Debian.

Enabling this feature may be a security risk, so it is disabled by default. If
in doubt, it is suggested to leave it disabled.

Should non-superusers be able to capture packets? [yes/no] yes

Answer 1

RUN DEBIAN_FRONTEND=noninteractive apt-get install -y tshark

无需用户交互即可安装。

Answer 2

首先，您通常必须（以避免键入“是”）：

RUN apt install -yq xxx

第二：

• 你可以查看这个tshark 镜像，它确实安装了 dumcap；通过编译wireshark，生成dumpcap。
• 替代方案（不编译，仅安装）是这个图像

在最后一种情况下，安装命令变为：

# Install build wireshark, need to run as root RUN apt-get update && \
    apt-get install -y wireshark && \
    groupadd wireshark && \
    usermod -aG wireshark developer && \
    setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap && \
    chgrp wireshark /usr/bin/dumpcap && \
    chmod 750 /usr/bin/dumpcap