This allows us to specify exposed ports at runtime in favor of patching the image manifests.
A typical call will look like this:

rkt run \
  --port shell:11111 \
  trusch.io/alpine \
    --expose shell,port=12345,protocol=tcp \
    --exec nc -- -lk -p 12345 -e /bin/sh

This fixes issue rkt#2113 and is conflicting with PR rkt#3407

…sts;