Hi, For pasta, would you consider an option to enable automatic forwarding of ports bound in a namespace, but make the forwarded ports available only via localhost, not all addresses? I'm working on a sandboxing program which uses pasta. The option -t "auto" is super convenient, but requires extra care, without proper firewall setup bound ports become automatically available to outside world. For a sandboxing program like mine, it is not a safe default to run with, because the program shouldn't assume the user will have a firewall configured. If something like "localhost/auto" was supported, it would match the convenience of "auto", no manual port mapping config would be needed, but would be safer for uses cases where exposing ports to outside world is problematic. Cheers, Jan