Bazel Cmake using foriegn rules unable to download external packages, but works locally

I am working on a bazel cpp project and I am trying to use cmake to integrate an external library.

I have the following build file

load("@rules_cc//cc:defs.bzl", "cc_library")
load("@rules_foreign_cc//foreign_cc:defs.bzl", "cmake")
    
cmake(
    name = "databento",
    build_args = [
        "-j16",
    ],
    lib_source = "@databento//:all",
    targets = [
        "install",
    ],
    visibility = ["//visibility:public"])

this is a snapshot of my workspace file

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

all_content = """filegroup(
    name = "all",
    srcs = glob(["**"]),
    visibility = ["//visibility:public"]
)
"""
http_archive(
    name = "databento",
     strip_prefix = "databento-cpp-0.14.1", 
    build_file_content = all_content,
    urls = ["https://github.com/databento/databento-cpp/archive/refs/tags/v0.14.1.tar.gz"],
    # build_file = "//library-bazel-builds:databento.BUILD",
)


load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_foreign_cc",
    # TODO: Get the latest sha256 value from a bazel debug message or the latest 
    #       release on the releases page: https://github.com/bazelbuild/rules_foreign_cc/releases
    #
    # sha256 = "...",
    strip_prefix = "rules_foreign_cc-51152aac9d6d8b887802a47ec08a1a37ef2c4885",
    url = "https://github.com/bazelbuild/rules_foreign_cc/archive/51152aac9d6d8b887802a47ec08a1a37ef2c4885.tar.gz",
)

load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")

rules_foreign_cc_dependencies()

Cmake works fine for building the same repository locally, but when I try to use bazel foreign rules, I get this:

-- Downloading...
   dst='/private/var/tmp/_bazel_root/1beb7f234b15119b93696bf5c0611a9f/sandbox/darwin-sandbox/9/execroot/Trading_Core/bazel-out/darwin_arm64-fastbuild/bin/Databento/databento.build_tmpdir/_deps/json-subbuild/json-populate-prefix/src/json.tar.xz'
   timeout='none'
   inactivity timeout='none'
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
-- Retrying...
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
-- Retry after 5 seconds (attempt #2) ...
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
-- Retry after 5 seconds (attempt #3) ...
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
-- Retry after 15 seconds (attempt #4) ...
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
-- Retry after 60 seconds (attempt #5) ...
-- Using src='https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz'
CMake Error at json-subbuild/json-populate-prefix/src/json-populate-stamp/download-json-populate.cmake:170 (message):
  Each download failed!

    error: downloading 'https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz' failed
          status_code: 7
          status_string: "Couldn't connect to server"
          log:
          --- LOG BEGIN ---
            Trying 140.82.112.3:443...

  Immediate connect fail for 140.82.112.3: Operation not permitted

  Closing connection 0

  

          --- LOG END ---
          error: downloading 'https://github.com/nlohmann/json/releases/download/v3.11.2/json.tar.xz' failed
          status_code: 7
          status_string: "Couldn't connect to server"
          log:
          --- LOG BEGIN ---
            Trying 140.82.112.3:443...

  Immediate connect fail for 140.82.112.3: Operation not permitted

  Closing connection 0

Any idea why this is happening?

Bazel’s sandbox by default blocks network access to try to improve hermeticity of its builds.

You can enable network access for a given target by adding the tag requires-network.

Depending on the rule implementation you may also need to pass --incompatible_allow_tags_propagation but the cmake build rules should not require this flag. You can set this in your projects .bazelrc file by including a line like common --incompatible_allow_tags_propagation.