Bind shim and exposed container ports to localhost (#3057)

Author: jvstme

runner/cmd/shim/main.go

@@ -240,7 +240,7 @@ func start(ctx context.Context, args shim.CLIArgs, serviceMode bool) (err error)
 		}
 	}
 
-	address := fmt.Sprintf(":%d", args.Shim.HTTPPort)
+	address := fmt.Sprintf("localhost:%d", args.Shim.HTTPPort)
 	shimServer := api.NewShimServer(ctx, address, Version, dockerRunner, dcgmExporter, dcgmWrapper)
 
 	defer func() {

runner/internal/shim/docker.go

@@ -982,7 +982,7 @@ func bindPorts(ports []int) nat.PortMap {
 	for _, port := range ports {
 		portMap[nat.Port(fmt.Sprintf("%d/tcp", port))] = []nat.PortBinding{
 			{
-				HostIP:   "0.0.0.0",
+				HostIP:   "127.0.0.1",
 				HostPort: "", // use ephemeral port from ip_local_port_range
 			},
 		}