port-forward needs socat on the node hosts; we technically
don't need it today on the master, but this seems the right
place to put it, and socat is a small dependency.