# Proxy settings for git, npm, pip, Docker, apt and other developer tools

Most command-line tools read the same three environment variables; the rest have one documented setting each. This page lists both, with the traps that cost an afternoon.


## The environment variables

```bash
export HTTP_PROXY="http://USER:PASS@res.hodlproxy.com:9000"
export HTTPS_PROXY="$HTTP_PROXY"
export NO_PROXY="localhost,127.0.0.1,.internal,.local"
# Some tools only read the lowercase names
export http_proxy="$HTTP_PROXY" https_proxy="$HTTPS_PROXY" no_proxy="$NO_PROXY"
```

- `HTTPS_PROXY` is the proxy used **for** HTTPS destinations; its value is still an `http://` URL, because the tool talks plain HTTP to the proxy and tunnels TLS through it.
- `NO_PROXY` lists hosts that must not go through the proxy: internal registries, metadata services, localhost.
- Special characters in the password must be URL-encoded (`@` becomes `%40`, `:` becomes `%3A`), or the URL is parsed wrongly.


## git

```bash
git config --global http.proxy http://USER:PASS@res.hodlproxy.com:9000
# Only for one host
git config --global http.https://github.com.proxy http://USER:PASS@res.hodlproxy.com:9000
# SOCKS5 with remote DNS
git config --global http.proxy socks5h://USER:PASS@res.hodlproxy.com:9001
# Remove it
git config --global --unset http.proxy
```

These settings cover HTTPS remotes only. SSH remotes need a `ProxyCommand`, for example with `ncat --proxy-type socks5 --proxy res.hodlproxy.com:9001 --proxy-auth USER:PASS %h %p` in `~/.ssh/config`.


## npm and yarn

```bash
npm config set proxy http://USER:PASS@res.hodlproxy.com:9000
npm config set https-proxy http://USER:PASS@res.hodlproxy.com:9000

# yarn 1
yarn config set proxy http://USER:PASS@res.hodlproxy.com:9000
yarn config set https-proxy http://USER:PASS@res.hodlproxy.com:9000

# yarn 2 and later
yarn config set httpProxy http://USER:PASS@res.hodlproxy.com:9000
yarn config set httpsProxy http://USER:PASS@res.hodlproxy.com:9000
```


## pip

```bash
pip install --proxy http://USER:PASS@res.hodlproxy.com:9000 requests

# Permanently, in pip.conf (Linux/macOS) or pip.ini (Windows)
[global]
proxy = http://USER:PASS@res.hodlproxy.com:9000
```

pip accepts a SOCKS5 proxy only when the PySocks package is installed; otherwise it fails with a missing-dependency error. On a fresh machine, use the HTTP port.


## Docker

Docker has two separate proxy settings, and mixing them up is the usual trap. The **daemon** pulls images and ignores your shell variables; the **client** passes proxy settings into builds and containers.

```ini
# /etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=http://USER:PASS@res.hodlproxy.com:9000"
Environment="HTTPS_PROXY=http://USER:PASS@res.hodlproxy.com:9000"
Environment="NO_PROXY=localhost,127.0.0.1"

# then
sudo systemctl daemon-reload && sudo systemctl restart docker
```

```json
{
  "proxies": {
    "default": {
      "httpProxy": "http://USER:PASS@res.hodlproxy.com:9000",
      "httpsProxy": "http://USER:PASS@res.hodlproxy.com:9000",
      "noProxy": "localhost,127.0.0.1"
    }
  }
}
```

On Docker Desktop, the daemon setting is under **Settings → Resources → Proxies**.


## apt

```text
Acquire::http::Proxy "http://USER:PASS@res.hodlproxy.com:9000/";
Acquire::https::Proxy "http://USER:PASS@res.hodlproxy.com:9000/";
```


## Go

The Go toolchain honours `HTTPS_PROXY` and `NO_PROXY`. `GOPROXY` is something else entirely: the address of a module mirror, not a network proxy, and changing it does not route traffic through an exit.


## Which exit to use

- Package registries and git hosts do not need residential trust: a [datacenter](https://hodlproxy.com/datacenter-proxies) address from $0.70 a month, with 100 GB per IP pooled, is the cheapest stable choice.
- If you use the rotating residential pool, hold a sticky session (`-sid-build1-ttl-30m`) so a large download does not change exit halfway.
- On servers, prefer the IP whitelist: no credentials in environment variables or config files that other users and processes can read.


## Questions

**Why is my HTTPS_PROXY value an http:// URL?**

Because it describes how the tool talks to the proxy, not the destination. The tool sends a CONNECT request over plain HTTP and then negotiates TLS with the destination through the tunnel.

**Does Docker use the HTTP_PROXY of my shell?**

The client does for builds that pass it through, but the daemon that pulls images does not: configure it in its systemd drop-in, or in Docker Desktop's proxy settings.

**What does NO_PROXY do?**

It lists hosts reached directly, bypassing the proxy: localhost, internal registries and cloud metadata addresses. Entries starting with a dot match a whole domain.

**Is GOPROXY a proxy server?**

No. GOPROXY points the Go toolchain at a module mirror. To route Go's network traffic through a proxy, set HTTPS_PROXY.

Source: https://hodlproxy.com/guides/developer-tools-proxy-settings