DNS resolution fails in Kubernetes when hostname has fewer dots than ndots

Codex fails to resolve custom model provider hostnames in Kubernetes environments due to incorrect handling of ndots and search domains in /etc/resolv.conf.

Environment

• codex-cli 0.142.4 (standalone linux musl)
• Running inside a Kubernetes pod
• /etc/resolv.conf:

``
search pi.svc.cluster.local svc.cluster.local cluster.local
ndots:5
``

• Model provider config:

``toml
[model_providers."custom"]
name = "Custom Proxy"
base_url = "http://llm.home.pi/v1"
wire_api = "responses"
``

Observed behavior

codex doctor reports:

✗ reachability one or more required provider endpoints are unreachable over HTTP
  reachability mode        provider auth
  custom API base URL      http://llm.home.pi/v1 connect failed (required)

DNS tracing shows codex resolves llm.home.pi as llm.home.pi.pi.svc.cluster.local. — it concatenates the first search domain without falling back to the original hostname.

Expected behavior

llm.home.pi (2 dots) should be resolved as-is when no search domain match is found, since 2 < 5 (ndots). curl, ping, dig all resolve llm.home.pi correctly on the same machine because they use glibc's getaddrinfo() which properly implements the ndots fallback algorithm.

Root cause

Codex uses an async DNS resolver (likely hickory-resolver/trust-dns) that doesn't correctly implement the ndots algorithm: when a hostname contains fewer dots than ndots, the resolver should first try appending each search domain, and if none resolve, fall back to resolving the original hostname as an absolute name. Codex's resolver stops at the first failure or never attempts the fallback.

Impact

This is a common Kubernetes issue — ndots:5 is the kubelet default, so many users running codex in containers will hit this.

Workarounds

• Add the hostname to /etc/hosts
• Use the IP address directly in base_url (e.g. http://192.168.100.200/v1)
• Set ndots:2 in the pod's dnsConfig

Suggested fix

Ensure the DNS resolver used by codex's HTTP client correctly implements the ndots algorithm:

1. When dots in hostname < ndots, try each search domain first
2. If no search domain resolves, fall back to the original hostname as an absolute FQDN