The first step would be to make sure to run each of the docker images within its own network namespace, and then populate each of those with virtual interfaces; perhaps ideally one interface for the (undisturbed) "local net", and another interface for the (disturbed) "wide area net".
Each local net interface would be "wired" to its own interface in the global namespaces, and then all those would be added to a bridge. That set up would provide to local net "cabling". You may then need to add a DHCP service on that net, or otherwise use static assignments.
Each WAN interface would likewise be wired to its own interface in the global namespace, and likewise all these would be added to another bridge, representing the cabling for the "WAN". This bridge would also have a main host IP, so as to allow the simulated WAN traffic to escape to "real" WAN. For that, you would set up iptables rules to channel the traffic, and effect disturbance by changing these rules.
If you want disturbances applied differently for different dockers, you would perhaps not bring them together in a bridge, but you would instead need to have individual channeling rules, and manipulate those for individual disturbances. Or alternatively, you do bring them into a bridge, and instead manipulate their virtual cabling (that connects each with its companion interface in a namespace)