绑定地址选择本地目的地，可达性还取决于完整路径

import json,re,subprocess,sys,tempfile
from pathlib import Path

image='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
program=r'''
from contextlib import ExitStack
import errno,json,socket

def read_exact(stream,length):
    result=b''
    while len(result)<length:
        part=stream.recv(length-len(result));assert part,'unexpected end of stream'
        result+=part
    return result
def listener(stack,address):
    stream=stack.enter_context(socket.socket(socket.AF_INET,socket.SOCK_STREAM))
    stream.settimeout(1);stream.bind((address,0));stream.listen(4)
    return stream
def exchange(server,address):
    with socket.create_connection((address,server.getsockname()[1]),timeout=1) as client:
        connection,peer=server.accept()
        with connection:
            connection.settimeout(1);client.sendall(b'ping');assert read_exact(connection,4)==b'ping'
            connection.sendall(b'pong');assert read_exact(client,4)==b'pong'
            assert connection.getsockname()[0]==address
            return {'listener':server.getsockname(),'accepted_local':connection.getsockname(),'peer':peer}
def refused(server,address):
    try:
        with socket.create_connection((address,server.getsockname()[1]),timeout=1):pass
    except ConnectionRefusedError:return 'ECONNREFUSED'
    raise AssertionError('unexpectedly connected')
with ExitStack() as stack:
    narrow=listener(stack,'127.0.0.1')
    one=exchange(narrow,'127.0.0.1');other=refused(narrow,'127.0.0.2')
    duplicate=stack.enter_context(socket.socket(socket.AF_INET,socket.SOCK_STREAM))
    try:duplicate.bind(narrow.getsockname());raise AssertionError('duplicate bind succeeded')
    except OSError as error:assert error.errno==errno.EADDRINUSE
    unassigned=stack.enter_context(socket.socket(socket.AF_INET,socket.SOCK_STREAM))
    try:unassigned.bind(('192.0.2.99',0));raise AssertionError('unassigned bind succeeded')
    except OSError as error:assert error.errno==errno.EADDRNOTAVAIL
    wildcard=listener(stack,'0.0.0.0')
    both=[exchange(wildcard,a) for a in ['127.0.0.1','127.0.0.2']]
    assert one['listener'][0]=='127.0.0.1'
    assert all(item['listener'][0]=='0.0.0.0' for item in both)
    print(json.dumps({'narrow':one,'other_loopback':other,'duplicate':'EADDRINUSE',
        'unassigned':'EADDRNOTAVAIL','wildcard':both}))
'''
def docker(*args,input=None,timeout=30):
    result=subprocess.run(['docker',*args],input=input,capture_output=True,text=True,timeout=timeout)
    assert result.returncode==0,result.stderr
    return result.stdout
def owned_id(path):
    value=path.read_text().strip()
    assert re.fullmatch('[0-9a-f]{64}',value),'missing or invalid owned container ID'
    return value
def remove_owned(paths):
    errors=[]
    for path in paths:
        try:
            cid=owned_id(path)
            print('Cleanup target: '+cid,file=sys.stderr)
            docker('rm','-f',cid,timeout=10)
        except Exception as error:
            errors.append(f'{path.name}: {error}')
    if errors:raise RuntimeError('Cleanup not confirmed; inspect the recorded IDs: '+'; '.join(errors))
with tempfile.TemporaryDirectory(prefix='xbcatm-bind-') as work:
    cidfile=Path(work)/'container.cid'
    try:
        docker('create','-i','--cidfile',str(cidfile),'--pull','never','--network','none',
            '--memory','128m','--pids-limit','64',image,'python3','-')
        cid=owned_id(cidfile)
        print('Owned container: '+cid,file=sys.stderr)
        output=docker('start','-a','-i',cid,input=program,timeout=60)
        assert docker('inspect','--format','{{.State.ExitCode}}',cid).strip()=='0'
        report=json.loads(output)
    finally:
        remove_owned([cidfile])
print(json.dumps(report,ensure_ascii=False,sort_keys=True))