Leave an IPv6 loopback mapping out of what a container publishes, reading ports from the end (hq ADR 0100)

2026-09-22 17:58:50 +02:00
parent 8db66e9532
commit a82bfb41f2
2 changed files with 17 additions and 13 deletions
@@ -336,3 +336,15 @@ func TestTheGuardIsDerivedFromTakenModulesOnly(t *testing.T) {
 		t.Fatalf("the guard does not follow the given ports:\n%s", got)
 	}
 }
+
+// A mapping bound to loopback is not published to anything off the machine — in either address
+// family — and an address's own colons never shift the ports.
+func TestPublishedLeavesOutLoopbackInBothFamilies(t *testing.T) {
+	got := Published([]map[string]any{{"type": "container", "ports": []any{
+		"127.0.0.1:15672:15672", "[::1]:8080:80", "localhost:9090:90",
+		"[::]:8443:443", "0.0.0.0:5000:5000", "5353:53/udp"}}})
+	want := map[string]map[int]int{"tcp": {8443: 443, 5000: 5000}, "udp": {5353: 53}}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("published is %v, want %v", got, want)
+	}
+}