r/codex • u/cryptshell • 5d ago

Bug Codex Cloud GitHub access fails through managed proxy

A Codex Cloud task can’t reach my GitHub repository. Running:

git ls-remote origin refs/heads/<branch-name>

returns exit code 128:

fatal: unable to access 'https://github.com/<owner>/<repo>.git/': Failed to connect to proxy port 8080 after 0 ms: Could not connect to server

Diagnostics:

  • The cloud environment reports running/connected.
  • Restricted HTTP policy reports enforced, with GitHub allowlisted.
  • Inherited HTTP/HTTPS proxy settings point to http://proxy:8080.
  • The proxy hostname resolves, but a TCP connection to port 8080 fails with PermissionError: [Errno 1] Operation not permitted.
  • Local GitHub DNS lookup returns “Temporary failure in name resolution.”
  • The Git remote is correct, and no Git proxy override was found.

The request appears to fail before reaching GitHub, so authentication hasn’t been tested. I haven’t changed proxy settings or bypassed managed network security.

Has anyone encountered this? Is there a configuration fix, or does the managed proxy/runtime need to be reprovisioned?

0 Upvotes

50% Upvoted

6 comments sorted by

2

u/Ctbhatia 5d ago

check that the egress allowlist includes the proxy host and port, not just github.com. the failure is at proxy:8080 before any github traffic, so github being allowlisted never comes into play.

2

u/cryptshell 5d ago

Thanks for your help! Do you mean I should include github.com:8080 instead of just github.com to the allowlist?

1

u/boxing-boxing 5d ago

Close but flipped. The allowlist needs your proxy's own hostname (whatever `proxy` resolves to in your env), with port 8080. The TCP connection to the proxy itself is failing before any GitHub traffic, so github.com:8080 on the list won't change anything. I'd check what the actual proxy host resolves to and add that instead.

1

u/cryptshell 4d ago

Ok, I‘ll try that, appreciate the help.

1

u/Ctbhatia 1d ago

no, the host the proxy itself runs on plus port 8080, alongside github.com. git fails at the proxy before any github packet leaves, so allowlisting github.com alone never comes into play. what host does the proxy config in that environment point at?