Prevent redirection of non-local packets

Without this fix, when we did `-p 80:8000` this resulted in *any tcp
connection to port 80* for *any ip address* to be redirected to the
container. Naturally, this broke the docker registry and any outbound
http connections, for that matter.