From 77beddbf15238b323a0ce060951c0a3157d091d1 Mon Sep 17 00:00:00 2001
From: John Logan <john_logan@apple.com>
Date: Wed, 13 May 2026 17:21:35 -0700
Subject: [PATCH] Relax host-only network test.

- Accept three different curl errors that would
  indicate container has no external access.
---
 Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift b/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift
index 0b7bb8a91..b20cd1eaa 100644
--- a/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift
+++ b/Tests/CLITests/Subcommands/Networks/TestCLINetwork.swift
@@ -265,10 +265,16 @@ class TestCLINetwork: CLITest {
                 name,
                 curlImage,
                 "curl",
+                "--connect-timeout",
+                "5",
                 "http://google.com",
             ])
 
-            #expect(failed == 6, "external connection should fail")
+            // hostOnly mode blocks off-host traffic; depending on whether vmnet/firewall
+            // rejects (7) or drops (28) packets, or DNS itself can't reach an external
+            // resolver (6), curl will fail with one of these codes.
+            let hostOnlyBlockedCodes: Set<Int32> = [6, 7, 28]
+            #expect(hostOnlyBlockedCodes.contains(failed), "external connection should fail")
         }
     }