Removes publish All by default and locks to localhost for port binding

pkg/engine/engine.go

@@ -43,6 +43,7 @@ type ContainerRef struct {
 	BestEffortArgs  []string
 	Privileged      bool
 	RemoveAfterExit bool
+	LocalPorts      map[string]int
 }
 
 type VolumeMount struct {
@@ -233,8 +234,14 @@ func parseRefToArgs(c ContainerRef) ([]string, error) {
 		args = append(args, "--rm")
 	}
 
+	// If PublishAll is set - publish all of the ports. Otherwise, bind each
+	// one individually to localhost.
 	if c.PublishAll {
 		args = append(args, "--publish-all")
+	} else if c.LocalPorts != nil {
+		for service, _ := range c.LocalPorts {
+			args = append(args, fmt.Sprintf("--publish=127.0.0.1::%d", c.LocalPorts[service]))
+		}
 	}
 
 	if c.Envs != nil {

pkg/ocmcontainer/ocmcontainer.go

@@ -151,7 +151,10 @@ func New(cmd *cobra.Command, args []string) (*ocmContainer, error) {
 	// disable-console-port is deprecated so this we're also checking the new --no-console-port flag
 	// This can be simplified when disable-console-port is deprecated and removed
 	if featureEnabled("console-port") && !viper.GetBool("disable-console-port") {
-		c.PublishAll = true
+		if c.LocalPorts == nil {
+			c.LocalPorts = map[string]int{}
+		}
+		c.LocalPorts["console"] = 9999
 	}
 
 	// GCloud configuration
@@ -262,7 +265,8 @@ func New(cmd *cobra.Command, args []string) (*ocmContainer, error) {
 }
 
 func (o *ocmContainer) consolePortEnabled() bool {
-	return o.container.Ref.PublishAll
+	_, ok := o.container.Ref.LocalPorts["console"]
+	return ok
 }
 
 func (o *ocmContainer) newConsolePortMap() error {