Auto forwarding ports, but only to localhost

[Jan Wrobel <jan@mixedbit.org>]

Hi,

For pasta, would you consider an option to enable automatic forwarding
of ports bound in a namespace, but make the forwarded ports available
only via localhost, not all addresses?

I'm working on a sandboxing program which uses pasta. The option -t
"auto" is super convenient, but requires extra care, without proper
firewall setup bound ports become automatically available to outside
world. For a sandboxing program like mine, it is not a safe default to
run with, because the program shouldn't assume the user will have a
firewall configured.

If something like "localhost/auto" was supported, it would match the
convenience of "auto", no manual port mapping config would be needed,
but would be safer for uses cases where exposing ports to outside
world is problematic.

Cheers,
Jan