Sandbox: allow outbound connections to localhost

Problem

The sandbox blocks outbound TCP connections to localhost/127.0.0.1/::1 even when these are listed in sandbox.network.allowedDomains. The sock.connect() syscall gets EPERM (Operation not permitted).

This makes it impossible to run integration tests against local Docker services (e.g. http://localhost:8000) from within the sandbox.

What I've tried

In settings.json:

"sandbox": {
  "enabled": true,
  "network": {
    "allowLocalBinding": true,
    "allowedDomains": [
      "localhost",
      "127.0.0.1",
      "::1"
    ]
  }
}

None of these settings allow the outbound connection. The only workaround is either dangerouslyDisableSandbox: true on every bash call, or adding the command to excludedCommands, both of which defeat the purpose of the sandbox.

Requested feature

A sandbox setting that allows outbound TCP connections to loopback addresses, e.g.:

"sandbox": {
  "network": {
    "allowLocalhostConnections": true
  }
}

Or have allowedDomains with localhost/127.0.0.1/::1 actually allow the TCP connection, not just DNS resolution.

Use case

Running integration tests against services in local Docker containers. For example, starting a service via docker compose and then running integration tests that hit http://localhost:8000.