Codex sandbox blocks DNS/SSH sockets; git push fails with "Could not resolve hostname github.com"

What version of Codex CLI is running?

codex-cli 0.104.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Linux 6.18.9-arch1-2 x86_64 unknown

What terminal emulator and version are you using (if applicable)?

Alacritty

What issue are you seeing?

Inside Codex sandbox, outbound networking and socket creation appear blocked.
Git operations to GitHub fail before authentication due to DNS failures.

Command:
git push origin --delete <REDACTED_BRANCH>

Output:
ssh: Could not resolve hostname github.com: Temporary failure in name resolution
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

DNS / network checks in sandbox:
getent hosts github.com && ssh -T git@github.com
<no output>

nslookup github.com || true; ping -c 1 github.com || true
net.c:136:try_proto(): socket(): Operation not permitted (1)
net.c:136:try_proto(): socket(): Operation not permitted (1)
(null): can't find either v4 or v6 networking
ping: socktype: SOCK_DGRAM
ping: socket: Operation not permitted

SSH agent:
ssh-add -l
Error connecting to agent: Operation not permitted

ssh-agent -s
Couldn't prepare agent socket
Operation not permitted

What steps can reproduce the bug?

1) Start Codex CLI in any git repo that has an SSH remote (git@github.com:...).
2) Run:
getent hosts github.com
git push --dry-run
3) Observe DNS/socket failures (Operation not permitted) and git push failure.

What is the expected behavior?

git push should proceed to authentication or fail with a normal SSH auth error,
not fail due to DNS/socket restrictions inside the Codex environment.

Additional information

• This is NOT the “Bad owner or permissions on /etc/ssh/ssh_config.d” issue.

In this environment, /etc/ssh and ssh_config.d are owned by root and
ssh -G github.com parses cleanly.

• The failure appears to be sandbox socket/network restrictions.
• When elevated execution was explicitly approved, git push/delete succeeded.
• /etc/resolv.conf contains a nameserver entry, but DNS lookups still fail in

sandbox.