Running Docker containers behind an authenticated HTTP proxy
Updated:
A Docker proxy setup starts with one question: which traffic should leave through the proxy? Docker has three separate paths (your app at runtime, docker build, and the daemon pulling images), and each reads its proxy from a different place. Get that right and every container on one host can exit through its own ProxyV4 IPv4 address while the host's routing table stays untouched.
ENV HTTP_PROXY=http://user:pass@ip:port HTTPS_PROXY=http://user:pass@ip:portThree places Docker reads a proxy from
Setting a variable in one scope does nothing for the other two. A common surprise is a working docker pull while the app inside the container still goes out on the host's own IP, or the reverse.
| Traffic | Configure it in | Typical content |
|---|---|---|
| Your application inside a running container | docker run -e HTTP_PROXY=... or the environment: block in Compose | Scraper requests, API calls, automation jobs |
Commands during docker build | --build-arg HTTP_PROXY=http://user:pass@ip:port | apt, pip and npm downloads in RUN steps |
| The Docker daemon itself | /etc/systemd/system/docker.service.d/http-proxy.conf | docker pull and docker push against registries |
One IP per container
Because the runtime variables live in each container's environment, a single VPS can run, say, ten workers where each one has a different http://user:pass@ip:port value. Every worker then shows its own exit address to the sites it visits, and since a ProxyV4 private IPv4 is rented to one customer only, nobody else's traffic shares that address.
Keep one .env file per service, or one Compose service per proxy, so you can see at a glance which IP belongs to which job. When you renew, you can keep the same addresses, so nothing in those files has to change.
Variables that keep the stack working
- Define the uppercase names (
HTTP_PROXY,HTTPS_PROXY,NO_PROXY) and the lowercase ones (http_proxy,https_proxy,no_proxy); different tools and runtimes look for different spellings - Put every Compose service name your app calls in
NO_PROXY, for exampleNO_PROXY=localhost,127.0.0.1,redis,postgres, so database and cache traffic stays on the bridge network instead of being sent to the proxy - Use the
http://scheme forHTTPS_PROXYtoo; the client opens a CONNECT tunnel and HTTPS sites stay encrypted - Do not write proxy passwords into a
DockerfilewithENV: they end up in the image layers. Inject them at runtime from.envor the Compose file
Step by step
- 1
Turn the order line into a proxy URL
Your ProxyV4 order lists
ip:port:user:pass; rewrite it ashttp://user:pass@ip:port, by hand or with the proxy format converter. - 2
Add the variables to the service
In
docker-compose.yml, under the service'senvironment:, setHTTP_PROXY,HTTPS_PROXY,http_proxy,https_proxyandNO_PROXY=localhost,127.0.0.1,redis,db. - 3
Recreate the container
Environment changes apply only to new containers, so run
docker compose up -dto recreate the service. - 4
Check the exit IP from inside
Run
docker exec -it <container> curl -s https://proxyv4.com/api/my-ip. The address returned should be the proxy IP, not the host's.
Frequently asked questions
After adding HTTP_PROXY my app cannot reach Redis or Postgres. Why?
The HTTP client is now sending requests for redis or db to the external proxy, which cannot resolve those internal names. List them in NO_PROXY (and no_proxy), e.g. NO_PROXY=localhost,127.0.0.1,redis,db, then recreate the container.
Can each container on one server use a different proxy?
Yes. Give each service, or each .env file, its own http://user:pass@ip:port value. The containers share the host but leave the internet on separate IPs.
Why set the proxy variables twice, in upper and lower case?
There is no single standard. Tools built on libcurl read lowercase http_proxy and https_proxy, while many Go and Node tools read the uppercase names. Setting both covers everything in the image.
Does `docker pull` use the variables I set in Compose?
No. Pulls are made by the daemon, which reads its proxy from the systemd drop-in /etc/systemd/system/docker.service.d/http-proxy.conf, not from container environments.
A separate private IPv4 for every container
Unmetered private IPv4 in 7 countries plus static ISP in the US and Vietnam, issued automatically after payment. No minimum order.
Check live Singapore prices