curl/https within sandbox fails with "insufficient randomness"

[hpcpony]

It's more likely that I'm missing something than that these are bugs so I'm submitting here. If this isn't the right place, please redirect me.

I ran into the following when trying to hookup my sandbox to a LiteLLM server but here's an even simpler example (based on the documentation: https://docs.nvidia.com/openshell/get-started/tutorials/first-network-policy).

Relevant environment:

[OpenShell] podman images
REPOSITORY                                         TAG                                       IMAGE ID      CREATED       SIZE
ghcr.io/nvidia/openshell/supervisor                8d67250a5d17348eb96c4fa46226b06d8041f2ba  6ff75988c133  7 days ago    33.4 MB
ghcr.io/nvidia/openshell-community/sandboxes/base  latest                                    65fa5d3d598a  2 months ago  3.42 GB

[OpenShell] openshell --version
openshell 0.0.109

[OpenShell] openshell-gateway --version
openshell-gateway 0.0.109

[OpenShell] podman --version
podman version 5.8.2

[OpenShell] cat /etc/redhat-release
Red Hat Enterprise Linux release 9.8 (Plow)

[OpenShell] uname -srv
Linux 5.14.0-687.38.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Aug 9 21:18:40 EDT 2026

My simple policy:

[OpenShell] cat policy-test.yml 
version: 1

# Static: locked at sandbox creation. Paths the agent can read vs read/write.
filesystem_policy:
  include_workdir: true
  read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
  read_write: [/sandbox, /tmp, /dev/null]

# Static: Landlock LSM kernel enforcement. best_effort uses highest ABI the host supports.
landlock:
  compatibility: best_effort

# Dynamic: hot-reloadable. Named blocks of endpoints + binaries allowed to reach them.
network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-write
    binaries:
      - path: /usr/bin/curl

When I create the sandbox and try to exercise a connection out of it there's a failure:

[OpenShell] openshell sandbox create --name test --policy policy-test.yml

Created sandbox: test

[OpenShell] openshell sandbox exec --name test --tty /usr/bin/bash
sandbox@sandbox-test:~$ curl https://api.github.com/zen
curl: (35) Insufficient randomness

Based on the log it seems to be finding the policy just fine:

[1787768202.366] [sandbox] [OCSF ] [ocsf] NET:OPEN [INFO] ALLOWED /usr/bin/curl(78) -> api.github.com:443 [policy:github_api engine:opa]

Any help appreciated.