Use TYO Reach with Docker

Docker involves three different network contexts, and each needs the proxy set separately: the daemon (image pulls), docker build (RUN steps), and running containers (your app's outbound requests). The catch is that Reach listens on 127.0.0.1 of your host, and inside a container 127.0.0.1 is the container itself — so you have to give Docker an address that reaches the host.

Which address reaches the host?

Where Docker runs	Use this instead of 127.0.0.1
Docker Desktop on macOS or Windows	host.docker.internal
Docker Engine on Linux (default bridge)	172.17.0.1 (the docker0 bridge IP — check with ip addr show docker0)
Docker Engine on Linux with --add-host	host.docker.internal after --add-host=host.docker.internal:host-gateway
--network host on Linux	127.0.0.1 works directly

1. Image pulls (the daemon)

Docker Desktop: Settings → Resources → Proxies → Manual, HTTP and HTTPS proxy http://127.0.0.1:8082 (the daemon runs on the host side here, so loopback is correct).

Docker Engine on Linux: create /etc/systemd/system/docker.service.d/proxy.conf:

[Service]
Environment="HTTP_PROXY=http://127.0.0.1:8082"
Environment="HTTPS_PROXY=http://127.0.0.1:8082"
Environment="NO_PROXY=localhost,127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.local"

then sudo systemctl daemon-reload && sudo systemctl restart docker. The daemon is a host process, so 127.0.0.1 is right here too.

2. docker build

RUN steps execute in a temporary container, so use the host-reachable address:

docker build \
  --build-arg HTTP_PROXY=http://host.docker.internal:8082 \
  --build-arg HTTPS_PROXY=http://host.docker.internal:8082 \
  --build-arg NO_PROXY=localhost,127.0.0.1 \
  -t myimage .

Docker passes the standard proxy build-args through to RUN automatically without declaring them in the Dockerfile, and they are not persisted into the image. Avoid ENV HTTP_PROXY in the Dockerfile itself — it bakes your local proxy into an image that will then fail everywhere else.

3. Running containers

docker run --rm \
  -e HTTPS_PROXY=http://host.docker.internal:8082 \
  -e HTTP_PROXY=http://host.docker.internal:8082 \
  -e NO_PROXY=localhost,127.0.0.1 \
  alpine wget -qO- https://myip.tyo.com.au

On Linux Engine add --add-host=host.docker.internal:host-gateway (Docker 20.10+) or use 172.17.0.1. To set it once for every container, put the same variables under proxies.default in ~/.docker/config.json:

{
  "proxies": {
    "default": {
      "httpProxy":  "http://host.docker.internal:8082",
      "httpsProxy": "http://host.docker.internal:8082",
      "noProxy":    "localhost,127.0.0.1"
    }
  }
}

Compose users: the same keys work under environment: for each service.

What to expect

• Only the container's HTTP(S) clients that honour proxy variables are routed — most languages' standard libraries do; some Go programs and anything doing raw TCP don't.
• Traffic is metered on personal plans like any other routed traffic; image pulls add up.
• When Reach is off, pulls and builds configured this way fail instead of going direct — remove the settings or switch Reach on.
• Routing rules and the exit region you picked in the tray apply.

Common questions

Can I give a container SOCKS5 instead?

Yes — ALL_PROXY=socks5h://host.docker.internal:1080 for clients that support it (curl, Python requests with pysocks). Docker's daemon and build-arg passthrough only understand the HTTP variables.

docker pull works but my container can't connect

The daemon uses the host's loopback; the container needs the host-reachable address from the table above. On Linux, also check the bridge address isn't excluded by a firewall rule and that Reach is actually on.

Does this work with Podman?

The same variables work; Podman's equivalent of host.docker.internal is host.containers.internal.