Bind shim, runner, and job ports to localhost only

Author: jvstme

runner/cmd/runner/main.go

@@ -38,7 +38,7 @@ func start(tempDir string, homeDir string, httpPort int, sshPort int, logLevel i
 	log.DefaultEntry.Logger.SetOutput(io.MultiWriter(os.Stdout, defaultLogFile))
 	log.DefaultEntry.Logger.SetLevel(logrus.Level(logLevel))
 
-	server, err := api.NewServer(tempDir, homeDir, fmt.Sprintf(":%d", httpPort), sshPort, version)
+	server, err := api.NewServer(tempDir, homeDir, fmt.Sprintf("localhost:%d", httpPort), sshPort, version)
 	if err != nil {
 		return tracerr.Errorf("Failed to create server: %w", err)
 	}

runner/cmd/shim/main.go

@@ -240,7 +240,7 @@ func start(ctx context.Context, args shim.CLIArgs, serviceMode bool) (err error)
 		}
 	}
 
-	address := fmt.Sprintf(":%d", args.Shim.HTTPPort)
+	address := fmt.Sprintf("localhost:%d", args.Shim.HTTPPort)
 	shimServer := api.NewShimServer(ctx, address, Version, dockerRunner, dcgmExporter, dcgmWrapper)
 
 	defer func() {

runner/internal/shim/docker.go

@@ -982,7 +982,7 @@ func bindPorts(ports []int) nat.PortMap {
 	for _, port := range ports {
 		portMap[nat.Port(fmt.Sprintf("%d/tcp", port))] = []nat.PortBinding{
 			{
-				HostIP:   "0.0.0.0",
+				HostIP:   "127.0.0.1",
 				HostPort: "", // use ephemeral port from ip_local_port_range
 			},
 		}