ci: add port-allowlist test for networking-py

Signed-off-by: danbugs <danilochiarlone@gmail.com>

Author: danbugs

.github/workflows/test-examples.yml

@@ -237,6 +237,10 @@ jobs:
             memory: "512Mi"
             args: "--net -- /urllib_get.py"
             expect: "SUCCESS: urllib GET worked!"
+          - example: networking-py
+            memory: "512Mi"
+            args: "--port 8080 -- /echo_server_test.py"
+            expect: "SUCCESS: bind\\+listen on port 8080 allowed"
     steps:
       - uses: actions/checkout@v4
 
@@ -569,6 +573,10 @@ jobs:
             memory: "512Mi"
             args: "--net -- /urllib_get.py"
             expect: "SUCCESS: urllib GET worked!"
+          - example: networking-py
+            memory: "512Mi"
+            args: "--port 8080 -- /echo_server_test.py"
+            expect: "SUCCESS: bind\\+listen on port 8080 allowed"
     steps:
       - uses: actions/checkout@v4
 

examples/networking-py/Dockerfile

@@ -9,6 +9,7 @@ COPY http_get.py /http_get.py
 COPY echo_server.py /echo_server.py
 COPY urllib_get.py /urllib_get.py
 COPY https_test.py /https_test.py
+COPY echo_server_test.py /echo_server_test.py
 
 # --- CPIO rootfs builder ---
 FROM alpine:3.20 AS cpio

examples/networking-py/echo_server_test.py

@@ -0,0 +1,17 @@
+"""Test that --port allows bind+listen and no --port would reject it.
+
+This is a run-to-completion test for CI: it binds, listens, then exits.
+The fact that bind+listen succeed (instead of raising OSError) proves
+the --port allowlist is working.
+"""
+import socket
+
+HOST = "0.0.0.0"
+PORT = 8080
+
+srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+srv.bind((HOST, PORT))
+srv.listen(1)
+srv.close()
+print("SUCCESS: bind+listen on port 8080 allowed")