Fix managed ingress loopback publication

tools/checks/managed-ingress-drill.py

@@ -7,6 +7,7 @@ import argparse
 from pathlib import Path
 import re
 import shutil
+import socket
 import subprocess
 import sys
 import tempfile
@@ -86,6 +87,16 @@ def _published_port(container: str, target: int) -> int:
         raise RuntimeError(f"cannot determine published port from {output!r}") from exc
 
 
+def _available_loopback_port(*, exclude: frozenset[int] = frozenset()) -> int:
+    for _attempt in range(10):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as listener:
+            listener.bind(("127.0.0.1", 0))
+            port = int(listener.getsockname()[1])
+        if port not in exclude:
+            return port
+    raise RuntimeError("cannot allocate distinct loopback ports for ingress drill")
+
+
 def _curl(url: str, *, headers: bool = False) -> str:
     argv = ["curl", "--silent", "--show-error", "--insecure"]
     if headers:
@@ -253,6 +264,10 @@ def main() -> int:
                     "/govoplan-config/Caddyfile",
                 ]
             )
+            requested_http_port = _available_loopback_port()
+            requested_https_port = _available_loopback_port(
+                exclude=frozenset({requested_http_port})
+            )
             ingress_command = [
                 "docker",
                 "run",
@@ -269,9 +284,9 @@ def main() -> int:
                 "--cap-drop",
                 "ALL",
                 "--publish",
-                "127.0.0.1::8080",
+                f"127.0.0.1:{requested_http_port}:8080/tcp",
                 "--publish",
-                "127.0.0.1::8443",
+                f"127.0.0.1:{requested_https_port}:8443/tcp",
                 "--mount",
                 (
                     "type=volume,"
@@ -291,6 +306,11 @@ def main() -> int:
             _run(ingress_command)
             http_port = _published_port(ingress, 8080)
             https_port = _published_port(ingress, 8443)
+            if (http_port, https_port) != (
+                requested_http_port,
+                requested_https_port,
+            ):
+                raise RuntimeError("Docker published unexpected ingress ports")
             body = _wait_for_https(https_port)
             if body.strip() != "proto=https":
                 raise RuntimeError(f"forwarded protocol was not normalized: {body!r}")