Bind VNC exclusively to IPv4 loopback and test listeners

chart/files/supervisord.conf

@@ -10,7 +10,7 @@ command=/usr/bin/Xvfb :0 -screen 0 %(ENV_RES)s -nolisten tcp
 autorestart=true
 
 [program:x11vnc]
-command=/usr/bin/x11vnc -localhost -forever -shared -nopw
+command=/usr/bin/x11vnc -localhost -listen 127.0.0.1 -no6 -forever -shared -nopw
 autorestart=true
 
 [program:novnc]

test.py

@@ -76,6 +76,9 @@ with tempfile.TemporaryDirectory(prefix='oldipmi-test-') as tmp:
                 assert data, 'VNC handshake closed early'
                 received += data
             assert b'101 Switching Protocols' in received
+        listeners = run('podman', 'exec', cid, 'netstat', '-lntp')
+        vnc_listeners = [line.split()[3] for line in listeners.splitlines() if 'x11vnc' in line]
+        assert vnc_listeners and all(address.startswith('127.0.0.1:') for address in vnc_listeners), listeners
         status = run('podman', 'exec', cid, 'cat', '/proc/1/status')
         assert 'NoNewPrivs:\t1' in status and 'CapEff:\t0000000000000000' in status
         assert run('podman', 'exec', cid, 'id', '-u') != '0'