Run tshark/wireshark In Docker

Last week when I was trying to run tshark in a Docker container to capture http packets, tshark reported following error even with root user:

tshark: Couldn't run /usr/bin/dumpcap in child process: Operation not permitted

After searching, to access dumcap, we need to add --cap-add options when start container, then add user into wireshark group:

docker run --cap-add=NET_RAW --cap-add=NET_ADMIN $IMAGE
usermod -a -G wireshark $USER