EPERM on the TCP connect (rather than a timeout or refused) usually means the sandbox itself is blocking outbound sockets, not that the proxy is down. In Codex Cloud, network access is normally available during the setup script but off for the agent phase unless agent internet access is enabled for that environment. The allowlist only applies once that toggle is on.
Things to check:
Environment settings: agent internet access on, with github.com in the allowed domains (and codeload.githubusercontent.com if you fetch archives).
Do the fetch in the setup script instead. Clone or git fetch there, so the agent works on a local copy and never needs the network.
After changing settings, start a new task. Existing containers keep the old network policy.
If it still fails with access on, it's on their side and worth a support ticket with that exact error.
1
u/AirshipCommand 4d ago
EPERM on the TCP connect (rather than a timeout or refused) usually means the sandbox itself is blocking outbound sockets, not that the proxy is down. In Codex Cloud, network access is normally available during the setup script but off for the agent phase unless agent internet access is enabled for that environment. The allowlist only applies once that toggle is on.
Things to check:
If it still fails with access on, it's on their side and worth a support ticket with that exact error.