allowedDomains works only when set to "*"

[jaromrax]

On linux, Ubuntu 24.04, 6.8.0-106-generic kernel,
I must use only "*" for allowedDomains

when I use this config in fence.jsonc

{
    "extends": "code",
    "network": {
	"deniedDomains": ["lupa.cz"],
	"allowedDomains": ["seznam.cz"],
	"allowLocalOutbound": true,
        "allowLocalOutboundPorts": [3128, 1080],
	"httpProxyPort":3128,
	"socksProxyPort":1080,
    },
    "filesystem": {
	"allowWrite": ["."],
	"denyRead":["~/.openai*","~/config/xyz/*"],
    },
    "command": { "deny": ["git push", "npm publish"] }
}

I cannot connect to inet at all:

fence curl https://opencode.ai
curl: (56) Proxy CONNECT aborted

fence curl https://seznam.cz  
curl: (56) Proxy CONNECT aborted

With "allowedDomains": ["*"], it works like a chime.

Even the proxy port is not detected as running when not using ["*"]:

if timeout 2 bash -c "echo >/dev/tcp/${HOST}/${p}" 2>/dev/null; then
        ok "port ${p} open"
    else
        fail "port ${p} closed  -> proxy not running?"
    fi

The start of the log file is :

[fence] Command: pi
[fence] Using config file: /home/ojr/.config/fence/fence.jsonc
[fence:http] HTTP proxy listening on localhost:36185
[fence:socks] SOCKS5 proxy listening on localhost:44457
[fence:linux] Starting HTTP bridge: socat UNIX-LISTEN:/tmp/fence-http-3d7a3fe5c730c7a0.sock,fork,reuseaddr TCP:localhost:36185
[fence:linux] Starting SOCKS bridge: socat UNIX-LISTEN:/tmp/fence-socks-3d7a3fe5c730c7a0.sock,fork,reuseaddr TCP:localhost:44457
[fence:linux] Bridges ready (HTTP: /tmp/fence-http-3d7a3fe5c730c7a0.sock, SOCKS: /tmp/fence-socks-3d7a3fe5c730c7a0.sock)
[fence:linux] Starting localhost-outbound bridge for port 3128: socat UNIX-LISTEN:/tmp/fence-lo--3128-adb32f1d6a86f786.sock,fork,reuseaddr,mode=0600 TCP:127.0.0.1:3128
[fence:linux] Starting localhost-outbound bridge for port 3128: socat UNIX-LISTEN:/tmp/fence-lo-6-3128-adb32f1d6a86f786.sock,fork,reuseaddr,mode=0600 TCP6:[::1]:3128
[fence:linux] Starting localhost-outbound bridge for port 1080: socat UNIX-LISTEN:/tmp/fence-lo--1080-adb32f1d6a86f786.sock,fork,reuseaddr,mode=0600 TCP:127.0.0.1:1080
[fence:linux] Starting localhost-outbound bridge for port 1080: socat UNIX-LISTEN:/tmp/fence-lo-6-1080-adb32f1d6a86f786.sock,fork,reuseaddr,mode=0600 TCP6:[::1]:1080
[fence:linux] Localhost-outbound bridges ready for ports: [3128 1080]
[fence] Sandbox manager initialized (HTTP proxy: 36185, SOCKS proxy: 44457)
[fence:linux] Available features: kernel 6.8, bwrap, seccomp+usernotif, landlock-v4
[fence:linux] Device mode: minimal
...```

[jaromrax]

May be I just miss something??? THank you