libcnb-test: ContainerConfig::expose_port exposes ports to the internet

[edmorley]

ContainerConfig::expose_port exposes ports on the started container to the host machine.

Currently libcnb-test does not set a host_ip in the corresponding PortBinding:

libcnb.rs/libcnb-test/src/container_port_mapping.rs

Line 82 in 95c2e81

host_ip: None,

https://docs.rs/bollard/latest/bollard/models/struct.PortBinding.html

The Bollard docs don't say what this implies, however, the Docker run docs say:

Note that ports which are not bound to the host (i.e., -p 80:80 instead of -p 127.0.0.1:80:80) are externally accessible.

(on https://docs.docker.com/engine/reference/commandline/run/#publish)

And on the networking page:

Publishing container ports is insecure by default. Meaning, when you publish a container’s ports it becomes available not only to the Docker host, but to the outside world as well.

If you include the localhost IP address (127.0.0.1) with the publish flag, only the Docker host can access the published container port.

(on https://docs.docker.com/network/#published-ports)

We should set the host_ip to 127.0.0.1, so that ports are only exposed to localhost, and not the internet.

IMO this is another example of how using Bollard makes it harder for us to understand what's going on, since Bollard's docs don't mention this pitfall, and it's not necessarily obvious at first glance how PortBinding correlates to the docker run options.