Finch is unable to pull images from public.ecr.aws after dropping off VPN

[austinvazquez]

Describe the bug
Customer report for unable to pull container images while on VPN. Initial root cause analysis we believe the issue to be limited to Finch on macOS 15. The exposure should be minimized as the issue requires users to start the Finch VM while on VPN and disconnect to reproduce.

Steps to reproduce

1. While connected to a VPN solution (reported issue used Cisco AnyConnect), initialize the Finch VM. i.e. finch vm init
2. Drop from the VPN.
3. Pull image from public.ecr.aws. i.e. finch pull public.ecr.aws/ubuntu/ubuntu:latest
4. Image pull fails due to timeout.

Expected behavior
DNS resolution for public.ecr.aws should succeed, and the image pull should not fail.

Screenshots or logs
If applicable, add screenshots or logs to help explain your problem.

Additional context
Potentially related issue: lima-vm/lima#2939

To help debug the issue as quickly as possible, we recommend generating a support bundle with finch support-bundle generate and attaching it to this issue. This packages all Finch-related configs and logs into one file.

[austinvazquez]

As a workaround, Finch users can do the following when disconnected from the VPN to mitigate impact:

finch vm stop
finch vm start