How to perform low-level inspecting of a Docker network traffic?
Turns out the answer is iptables, by adding a simple rule:

sudo iptables -I FORWARD -s &lt;source ip&gt; -j TEE --gateway &lt;destination ip&gt;


e.g.:  

sudo iptables -I FORWARD -s 172.19.0.3 -j TEE --gateway 172.19.0.4


I can clone the traffic, so if I do this:

sudo iptables -I FORWARD -s &lt;Container1 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;
sudo iptables -I FORWARD -s &lt;Container2 IP&gt; -j TEE --gateway &lt;Wireshark Container IP&gt;


I will clone all traffic going between Containers1 and 2 to Wireshark container.

(Note that although this solution is a proof of concept, at the time of writing this answer)