LeetCode Sandbox Outbound DNS Resolution Constraints

DNS Resolution Constraints

The LeetCode execution sandbox explicitly blocks outbound DNS queries at the system level. This restriction is enforced via host-level network policies (such as iptables or Kubernetes NetworkPolicies) to prevent platform abuse and ensure execution remains deterministic.

Expected Runtime Behavior

Because the restriction occurs at the network layer rather than through a language-specific security manager, the runtime does not typically throw a SecurityException. Instead, the behavior mimics a network timeout or a failure to locate the host.

• Java: Typically throws java.net.UnknownHostException.
• Python: Raises socket.gaierror (Get Address Info Error).
• C++: getaddrinfo() returns a non-zero error code (typically EAI_AGAIN or EAI_NONAME).

Likely Implementation Logic

While LeetCode does not publish its internal sandbox architecture, the observed behavior suggests a network-level block rather than a system call intercept. In most containerized environments of this type, the /etc/resolv.conf file is either empty or pointed to a non-functional local loopback address, causing the resolver to fail after a predefined timeout period.

Verification and Diagnostics

To confirm if your specific environment is experiencing a DNS block versus a general network outage, you can use the following scoped tests:

1. DNS Resolution Test (Python)

import socket
try:
    socket.getaddrinfo('google.com', 80)
except Exception as e:
    print(f"DNS Error: {e}")

2. Direct IP Connectivity Test

Attempt to connect to a known public IP (e.g., 8.8.8.8) using a raw socket. If the IP connection succeeds but the domain resolution fails, the sandbox is specifically blocking DNS traffic (UDP/TCP port 53).

Recommended Workarounds

1. Pre-resolved IPs: Use static IP addresses instead of domain names for any required external endpoints.
2. HTTPS-based DNS: If outbound HTTPS is permitted, use a REST-based DNS API (e.g., Google Public DNS over HTTPS) to resolve domains via standard HTTP requests.
3. Static Mapping: Implement a hard-coded dictionary/map of domain names to IP addresses within your code.

Diagnostic Detail Needed: To refine this recommendation, please specify if you are receiving an immediate "Host not found" error or if the execution hangs until a TLE (Time Limit Exceeded) occurs, as this distinguishes between a rejected packet and a dropped packet.