如何在Docker上安装tshark？

Question

我想在带有Dockerfile的Docker for Mac上的ubuntu17.04上安装tshark。我正在使用docker-compose

在apt install tshark中，会出现以下提示。

尽管我键入了yes，但系统仍提示停止安装。

如何在Dockerfile中安装tshark？

Dumpcap can be installed in a way that allows members of the "wireshark" system
group to capture packets. This is recommended over the alternative of running
Wireshark/Tshark directly as root, because less of the code will run with
elevated privileges.

For more detailed information please see
/usr/share/doc/wireshark-common/README.Debian.

Enabling this feature may be a security risk, so it is disabled by default. If
in doubt, it is suggested to leave it disabled.

Should non-superusers be able to capture packets? [yes/no] yes

Answer 1

RUN DEBIAN_FRONTEND=noninteractive apt-get install -y tshark

无需用户交互即可安装。

Answer 2

首先，您通常需要(为了避免必须键入“yes”)：

RUN apt install -yq xxx

第二：

• 你可以查看这个tshark image，它确实安装了dumcap；通过编译wireshark，它产生了dumpcap。
• 另一种选择(不编译，只安装)是dumcap

在最后一种情况下，install命令变为：

# Install build wireshark, need to run as root RUN apt-get update && \
    apt-get install -y wireshark && \
    groupadd wireshark && \
    usermod -aG wireshark developer && \
    setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap && \
    chgrp wireshark /usr/bin/dumpcap && \
    chmod 750 /usr/bin/dumpcap