How to capture packets for single docker container

You can bind to the network namespace of one container to another:

docker run -it --rm --net container:<container_name> \
  nicolaka/netshoot tcpdump ...

To see more about the netshoot image used above, see: https://github.com/nicolaka/netshoot