Are you looking to run RoCE traffic over the VF or ip traffic?
for ip traffic you can use this - Rakurai/pipework · GitHub. here is the explanation on how it works - Exposing Docker containers with SR-IOV .
The idea is to move the interface into the container network namespace. Note that this works for probed VFs (to the host OS).
If you plan to run the commands manually note that 'ip netns exec ... ' will not work since docker is not creating the required symlinks. use nsenter -t <contanier pid> -n <command>, for example - nsenter -t 28685 -n ip addr show
Regarding RoCE - RDMA-CM is sadly not aware of network names spaces at the moment. As a result, for time being, you cannot use RoCE from containers that are not part of the host network name space. Some work is being done to enable it.
I will do some research on RoCE and fixed MAC and get back to you soon.
I've done only basic testing so if you see any issues please let me know.