Configuring Docker Proxy Settings for Daemon, Containers, and Build Processes

When network restrictions such as corporate NAT require a proxy, Docker’s proxy configuration can be applied in three main scenarios, all based on setting the standard http_proxy, https_proxy, and no_proxy environment variables.

Docker daemon (dockerd) proxy : The docker pull command is executed by the daemon, so the proxy must be defined in the daemon’s environment, which is managed by systemd. Create a drop‑in directory and a proxy.conf file:

sudo mkdir -p /etc/systemd/system/docker.service.d
touch /etc/systemd/system/docker.service.d/proxy.conf

Then add the following lines to proxy.conf (replace proxy.example.com:8080 with your actual proxy):

[Service]
Environment="HTTP_PROXY=http://proxy.example.com:8080/"
Environment="HTTPS_PROXY=http://proxy.example.com:8080/"
Environment="NO_PROXY=localhost,127.0.0.1,.example.com"

After editing, reload systemd and restart Docker:

systemctl daemon-reload
systemctl restart docker

Container‑level proxy : For containers that need outbound access, configure the client‑side file ~/.docker/config.json. The following JSON is effective for Docker 17.07+:

{
  "proxies": {
    "default": {
      "httpProxy": "http://proxy.example.com:8080",
      "httpsProxy": "http://proxy.example.com:8080",
      "noProxy": "localhost,127.0.0.1,.example.com"
    }
  }
}

This user‑level configuration is convenient for development machines; however, in CI/CD pipelines or production environments it is often preferable to inject proxy variables directly with -e flags to avoid dependence on the client config.

Docker build proxy : Although docker build runs inside a temporary container, the daemon‑level proxy does not apply. Pass proxy settings as build arguments:

docker build . \
  --build-arg "HTTP_PROXY=http://proxy.example.com:8080/" \
  --build-arg "HTTPS_PROXY=http://proxy.example.com:8080/" \
  --build-arg "NO_PROXY=localhost,127.0.0.1,.example.com" \
  -t your/image:tag

Note that both docker run and docker build operate in an isolated network by default; if the proxy is only reachable via localhost:3128, you must use --network host or configure the proxy with an external IP and enable gateway mode.