CoderBoost

Docker

Pulling images (the daemon) and network access inside containers (container processes) are two separate things, configured separately.

1 minUpdated 2026-10-15

1. Make docker pull use the proxy (daemon)

Docker Desktop (macOS / Windows): Settings → Resources → Proxies, choose Manual and enter:

  • Web Server (HTTP): http://127.0.0.1:7898
  • Secure Web Server (HTTPS): http://127.0.0.1:7898

In some Docker Desktop versions the proxy connection starts inside the VM, where 127.0.0.1 means the VM itself. If it doesn't work, use http://host.docker.internal:7898 instead and turn on the shared proxy in the client.

Native Docker on Linux (dockerd runs on the host):

bash
sudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/systemd/system/docker.service.d/proxy.conf <<'EOF'
[Service]
Environment="HTTP_PROXY=http://127.0.0.1:7898"
Environment="HTTPS_PROXY=http://127.0.0.1:7898"
Environment="NO_PROXY=localhost,127.0.0.1"
EOF
sudo systemctl daemon-reload && sudo systemctl restart docker

2. Make programs inside containers use the proxy

Inside a container, 127.0.0.1 is the container itself, not the host.

  • Docker Desktop: containers reach the host as host.docker.internal:
bash
docker run --rm -e HTTPS_PROXY=http://host.docker.internal:7898 alpine wget -qO- https://github.com
  • Native Docker on Linux: first turn on the shared proxy in the client, allow the Docker range (for example 172.17.0.0/16) and create credentials for the container:
bash
cnb share on --cidr 172.17.0.0/16
cnb share credential create docker-dev   # the password is shown only once
docker run --rm -e HTTPS_PROXY=http://docker-dev:<password>@172.17.0.1:<port> alpine wget -qO- https://github.com

The shared proxy's listening address and port are whatever cnb share status reports.

3. When building images

bash
docker build --build-arg HTTPS_PROXY=http://host.docker.internal:7898 .

Don't put the proxy address or password in a Dockerfile ENV, or it will stay in the image layers.