Bind credential listener to localhost

[samuelkarp]

Summary

Bind to 127.0.0.1 and set portproxy to 127.0.0.1 instead of 169.254.170.2

Implementation details

Bind to 127.0.0.1 and set portproxy to 127.0.0.1 instead of 169.254.170.2

Existing behavior is preserved for Linux just because I haven't tested all possible configurations on Linux (especially the net=bridge configuration).

Testing

• Builds on Linux (make release)
• Builds on Windows (go build -out amazon-ecs-agent.exe ./agent)
• Unit tests on Linux (make test) pass
• Unit tests on Windows (go test -timeout=25s ./agent/...) pass
• Integration tests on Linux (make run-integ-tests) pass
• Integration tests on Windows (.\scripts\run-integ-tests.ps1) pass
• Functional tests on Linux (make run-functional-tests) pass
• Functional tests on Windows (.\scripts\run-functional-tests.ps1) pass
• Manually tested that credentials endpoint could be reached from a container
• Manually tested that credentials endpoint could be reached on the same host
• Manually tested that credentials endpoint could not be reached from a host in the same subnet

New tests cover the changes: no

Description for the changelog

none

Licensing

This contribution is under the terms of the Apache 2.0 License: yes

[ofiliz]

LGTM

[nmeyerhans]

The powershell bits look right, but I don't know. 🤷‍♂️

Golang bits look good.