Network icc

guests shouldn't be able communicate between each other when docker param `--icc=false`
I've had a few too many really bad experiences with non-deterministic tests bound to execution speed or external aspects like clocks.  Here, just some really simple bounds-checking is probably good enough.  You may even consider wrapping ``time.time()`` to just return an ever-incrementing value.  We really only need to check that known-input values map directly to some fixed results.  Anything beyond that is just extraneous.