ssh gitlab.com: Could not resolve hostname gitlab.com: Temporary failure in name resolution

[Moranilt]

Can someone help me how to setup gitlab inside of a sanbox using policy for ssh? Or only https solution will work?

ssh -T git@gitlab.com
ssh: Could not resolve hostname gitlab.com: Temporary failure in name resolution

I've tryed this:

preset:
  name: gitlab
  description: "GitLab SSH and DNS resolution"
network_policies:
  gitlab-ssh:
    name: gitlab-ssh
    endpoints:
      - host: gitlab.com
        port: 22
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { path: "/**" }
    binaries:
      - { path: /usr/bin/ssh }
      - { path: /usr/bin/git }
  gitlab-https:
    name: gitlab-https
    endpoints:
      - host: gitlab.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
          - allow: { method: PUT, path: "/**" }
          - allow: { method: DELETE, path: "/**" }
    binaries:
      - { path: /usr/bin/curl }
      - { path: /usr/bin/git }

But it doesn't work with ssh. It's resolving gitlab.com using curl through https, but with ssh I've got an error.

[Advait251206]

From the error:

ssh: Could not resolve hostname gitlab.com: Temporary failure in name resolution

this looks like a DNS resolution failure, not an SSH policy issue.

Your network policy already allows connections to:

host: gitlab.com
port: 22

However, before SSH can connect, it first has to resolve gitlab.com to an IP address. If DNS isn't permitted (or isn't available inside the sandbox), SSH will fail before it even attempts to open port 22.

A few things I'd check:

1. Verify DNS works inside the sandbox

Try:

getent hosts gitlab.com

or

nslookup gitlab.com

or

dig gitlab.com

If these fail with the same error, then the issue is DNS rather than SSH.

---

2. Confirm ssh is actually the binary being executed

Depending on how Git is configured, git may invoke:

/usr/bin/ssh

or

/usr/bin/ssh.exe

or another binary via GIT_SSH/GIT_SSH_COMMAND.

You can verify with:

which ssh
git config --get core.sshCommand
echo $GIT_SSH_COMMAND

The policy must allow the exact binary path being executed.

---

3. Check whether raw SSH is currently supported

OpenShell's network policies are primarily documented around HTTP/HTTPS endpoints. While you've specified:

port: 22
protocol: rest

I'm not sure whether SSH traffic is currently supported in the same way, or whether protocol: rest only applies to HTTP-based traffic.

If SSH isn't currently supported by the network policy engine, that would explain why HTTPS works while SSH does not.

---

4. Test connectivity independently of Git

Try:

ssh -vvv git@gitlab.com

The verbose output will show whether the failure occurs:

• before DNS resolution,
• during DNS resolution,
• while opening the TCP connection,
• or during SSH authentication.

That information would help narrow down whether this is a policy issue or a networking limitation.

---

5. HTTPS may currently be the supported approach

Since you've confirmed that HTTPS works while SSH does not, it's possible that Git over HTTPS is the intended workflow for now, with SSH support either requiring additional configuration or not yet being implemented.

If a maintainer can clarify whether outbound SSH (port 22) is officially supported through OpenShell network policies, that would answer whether this is expected behavior or a bug.

---

If this answer helped or pointed you in the right direction, I'd appreciate it if you could mark it as the accepted answer so it's easier for others with the same issue to find.

Also, if you found my contribution useful, I'd appreciate it if you could check out my GitHub profile, follow me, and star any repositories you find interesting.

GitHub: https://github.com/Advait251206