Proxy Settings for git, npm, pip, Docker and apt

The environment variables#

Shell (bash, zsh)

export HTTP_PROXY="http://USER:PASS@res.hodlproxy.com:9000"
export HTTPS_PROXY="$HTTP_PROXY"
export NO_PROXY="localhost,127.0.0.1,.internal,.local"
# Some tools only read the lowercase names
export http_proxy="$HTTP_PROXY" https_proxy="$HTTPS_PROXY" no_proxy="$NO_PROXY"

HTTPS_PROXY is the proxy used for HTTPS destinations; its value is still an http:// URL, because the tool talks plain HTTP to the proxy and tunnels TLS through it.
NO_PROXY lists hosts that must not go through the proxy: internal registries, metadata services, localhost.
Special characters in the password must be URL-encoded (@ becomes %40, : becomes %3A), or the URL is parsed wrongly.

git#

git over HTTPS

git config --global http.proxy http://USER:PASS@res.hodlproxy.com:9000
# Only for one host
git config --global http.https://github.com.proxy http://USER:PASS@res.hodlproxy.com:9000
# SOCKS5 with remote DNS
git config --global http.proxy socks5h://USER:PASS@res.hodlproxy.com:9001
# Remove it
git config --global --unset http.proxy

These settings cover HTTPS remotes only. SSH remotes need a ProxyCommand, for example with ncat --proxy-type socks5 --proxy res.hodlproxy.com:9001 --proxy-auth USER:PASS %h %p in ~/.ssh/config.

npm and yarn#

npm, yarn 1 and yarn 2+

npm config set proxy http://USER:PASS@res.hodlproxy.com:9000
npm config set https-proxy http://USER:PASS@res.hodlproxy.com:9000

# yarn 1
yarn config set proxy http://USER:PASS@res.hodlproxy.com:9000
yarn config set https-proxy http://USER:PASS@res.hodlproxy.com:9000

# yarn 2 and later
yarn config set httpProxy http://USER:PASS@res.hodlproxy.com:9000
yarn config set httpsProxy http://USER:PASS@res.hodlproxy.com:9000

pip#

pip

pip install --proxy http://USER:PASS@res.hodlproxy.com:9000 requests

# Permanently, in pip.conf (Linux/macOS) or pip.ini (Windows)
[global]
proxy = http://USER:PASS@res.hodlproxy.com:9000

pip accepts a SOCKS5 proxy only when the PySocks package is installed; otherwise it fails with a missing-dependency error. On a fresh machine, use the HTTP port.

Docker#

Docker has two separate proxy settings, and mixing them up is the usual trap. The daemon pulls images and ignores your shell variables; the client passes proxy settings into builds and containers.

Daemon (Linux, systemd)

# /etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=http://USER:PASS@res.hodlproxy.com:9000"
Environment="HTTPS_PROXY=http://USER:PASS@res.hodlproxy.com:9000"
Environment="NO_PROXY=localhost,127.0.0.1"

# then
sudo systemctl daemon-reload && sudo systemctl restart docker

Builds and containers (~/.docker/config.json)

{
  "proxies": {
    "default": {
      "httpProxy": "http://USER:PASS@res.hodlproxy.com:9000",
      "httpsProxy": "http://USER:PASS@res.hodlproxy.com:9000",
      "noProxy": "localhost,127.0.0.1"
    }
  }
}

On Docker Desktop, the daemon setting is under Settings → Resources → Proxies.

apt#

/etc/apt/apt.conf.d/95proxy

Acquire::http::Proxy "http://USER:PASS@res.hodlproxy.com:9000/";
Acquire::https::Proxy "http://USER:PASS@res.hodlproxy.com:9000/";

Go#

The Go toolchain honours HTTPS_PROXY and NO_PROXY. GOPROXY is something else entirely: the address of a module mirror, not a network proxy, and changing it does not route traffic through an exit.

Which exit to use#

Package registries and git hosts do not need residential trust: a datacenter address from $0.70 a month, with 100 GB per IP pooled, is the cheapest stable choice.
If you use the rotating residential pool, hold a sticky session (-sid-build1-ttl-30m) so a large download does not change exit halfway.
On servers, prefer the IP whitelist: no credentials in environment variables or config files that other users and processes can read.

Questions people ask#

Why is my HTTPS_PROXY value an http:// URL?

Because it describes how the tool talks to the proxy, not the destination. The tool sends a CONNECT request over plain HTTP and then negotiates TLS with the destination through the tunnel.

Does Docker use the HTTP_PROXY of my shell?

The client does for builds that pass it through, but the daemon that pulls images does not: configure it in its systemd drop-in, or in Docker Desktop's proxy settings.

What does NO_PROXY do?

It lists hosts reached directly, bypassing the proxy: localhost, internal registries and cloud metadata addresses. Entries starting with a dot match a whole domain.

Is GOPROXY a proxy server?

No. GOPROXY points the Go toolchain at a module mirror. To route Go's network traffic through a proxy, set HTTPS_PROXY.

Proxies

Menu

Proxy settings for git, npm, pip, Docker, apt and other developer tools