Docker容器无法绕过代理访问Docker网络的问题求助

问题现象 #

• 已配置Docker代理可正常拉取镜像，但同一docker-compose网络内的容器无法互相访问
• 手动将docker-compose网络添加到Docker的no_proxy变量可临时解决，但需逐个配置并重启Docker，不具备扩展性
• 即使no_proxy包含172.16.0.0/12（覆盖容器所在的172.30.0.5网段），直接访问容器IP仍会走代理，仅显式添加具体IP才有效；直接使用容器名访问同样失败

当前Docker代理配置脚本 #

cat << "EOF" >docker_proxy_setup.sh
#!/bin/bash

#Proxy
#ActiveProxyVar=127.0.0.1:80


#Domain
corpdom=domain.org

httpproxyvar=http://$ActiveProxyVar/
httpsproxyvar=http://$ActiveProxyVar/

mkdir ~/.docker
cat << EOL >~/.docker/config.json
{
 "proxies":
 {
   "default":
   {
     "httpProxy": "$httpproxyvar",
     "httpsProxy": "$httpsproxyvar",
     "noProxy": ".$corpdom,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
   }
 }
}
EOL

mkdir -p /etc/systemd/system/docker.service.d

cat << EOL >/etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=$httpproxyvar"
Environment="HTTPS_PROXY=$httpproxyvar"
Environment="NO_PROXY=.$corpdom,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
EOL

systemctl daemon-reload
systemctl restart docker
#systemctl show --property Environment docker

docker run hello-world
EOF
chmod +x docker_proxy_setup.sh
docker_proxy_setup.sh

容器内测试结果 #

root@icinga2-web:/# ping icinga2-api
PING icinga2-api (172.30.0.5) 56(84) bytes of data.
64 bytes from icinga2-api.icinga_icinga-net (172.30.0.5): icmp_seq=1 ttl=64 time=0.138 ms
64 bytes from icinga2-api.icinga_icinga-net (172.30.0.5): icmp_seq=2 ttl=64 time=0.077 ms
^C
--- icinga2-api ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1025ms
rtt min/avg/max/mdev = 0.077/0.107/0.138/0.030 ms


root@icinga2-web:/# curl --noproxy -k -u root:c54854140704eafc https://172.30.0.5:5665/v1/objects/hosts
curl: (56) Received HTTP code 503 from proxy after CONNECT


root@icinga2-web:/# curl -k -u root:c54854140704eafc https://172.30.0.5:5665/v1/objects/hosts
curl: (56) Received HTTP code 503 from proxy after CONNECT


root@icinga2-web:/# curl -k -u root:c54854140704eafc https://icinga2-api:5665/v1/objects/hosts
curl: (56) Received HTTP code 503 from proxy after CONNECT


root@icinga2-web:/# curl -k -u root:c54854140704eafc https://icinga2-api.icinga_icinga-net:5665/v1/objects/hosts
{"results":[{"attrs":{"__name":"icinga2-api","acknowledgement":0,"acknowledgement_expiry":0,"acknowledgement_last_change":0,"action_url":"","active":true,"address":"127.0.0.1","address6":"::1","check_attempt":1,"check_command":"hostalive","check_interval":60,"check_period":"","check_timeout":null,"command_endpoint":"","display_name":"icinga2-api","downtime_depth":0,"enable_active_checks":true,"enable_event_handler":true,"enable_flapping":false,"enable_notifications":true,"enable_passive_checks":true,"enable_perfdata":true,"event_command":"","executions":null,"flapping":false,"flapping_current":0,"flapping_ignore_states":null,"flapping_last_change":0,"flapping_threshold":0,"flapping_threshold_high":30,"flapping_threshold_low":25,"force_next_check":false,"force_next_notification":false,"groups":["linux-servers"],"ha_mode":0,"handled":false,"icon_image":"","icon_image_alt":"","last_check":1663091644.161905,"last_check_result":{"active":true,"check_source":"icinga2-api","command":["/usr/lib/nagios/plugins/check_ping","-H","127.0.0.1","-c","5000,100%","-w","3000,80%"],"execution_end":1663091644.161787,"execution_start":1663091640.088944,"exit_status":0,"output":"PING OK - Packet loss = 0%, RTA = 0.05 ms","performance_data":["rta=0.055000ms;3000.000000;5000.000000;0.000000","pl=0%;80;100;0"],"previous_hard_state":99,"schedule_end":1663091644.161905,"schedule_start":1663091640.087908,"scheduling_source":"icinga2-api","state":0,"ttl":0,"type":"CheckResult","vars_after":{"attempt":1,"reachable":true,"state":0,"state_type":1},"vars_before":{"attempt":1,"reachable":true,"state":0,"state_type":1}},"last_hard_state":0,"last_hard_state_change":1663028345.921676,"last_reachable":true,"last_state":0,"last_state_change":1663028345.921676,"last_state_down":0,"last_state_type":1,"last_state_unreachable":0,"last_state_up":1663091644.161787,"max_check_attempts":3,"name":"icinga2-api","next_check":1663091703.191943,"next_update":1663091771.339701,"notes":"","notes_url":"","original_attributes":null,"package":"_etc","paused":false,"previous_state_change":1663028345.921676,"problem":false,"retry_interval":30,"severity":0,"source_location":{"first_column":1,"first_line":18,"last_column":20,"last_line":18,"path":"/etc/icinga2/conf.d/hosts.conf"},"state":0,"state_type":1,"templates":["icinga2-api","generic-host"],"type":"Host","vars":{"disks":{"disk":{},"disk /":{"disk_partitions":"/"}},"http_vhosts":{"http":{"http_uri":"/"}},"notification":{"mail":{"groups":["icingaadmins"]}},"os":"Linux"},"version":0,"volatile":false,"zone":""},"joins":{},"meta":{},"name":"icinga2-api","type":"Host"}]} 
root@icinga2-web:/#

已尝试的临时解决方法 #

• 在Docker服务配置中添加小写代理环境变量，同时在docker-compose的容器环境中配置大小写NO_PROXY变量，通过.env设置后可正常通信，但无法通过CIDR规则自动生效
• 将docker-compose网络名（如icinga_icinga-net）加入no_proxy后，仅使用容器名.网络名的FQDN访问才能成功，直接用容器名或IP仍失败

解决方案 #

1. 修复Docker代理配置中的CIDR识别问题 #

部分系统或代理客户端对CIDR格式的no_proxy支持不佳，需完善配置：

• 修改/etc/systemd/system/docker.service.d/http-proxy.conf，同时配置大小写环境变量：

  [Service]
  Environment="HTTP_PROXY=http://127.0.0.1:80/"
  Environment="HTTPS_PROXY=http://127.0.0.1:80/"
  Environment="NO_PROXY=.$corpdom,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,localhost,*.local"
  Environment="http_proxy=http://127.0.0.1:80/"
  Environment="https_proxy=http://127.0.0.1:80/"
  Environment="no_proxy=.$corpdom,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,localhost,*.local"
  

• 重启Docker服务：systemctl daemon-reload && systemctl restart docker

2. 配置docker-compose自动注入no_proxy规则 #

在docker-compose.yml中为所有容器添加环境变量，自动包含Docker默认内网段及当前网络的域名后缀：

version: '3.8'
services:
  icinga2-api:
    ...
    environment:
      - HTTP_PROXY=${HTTP_PROXY}
      - HTTPS_PROXY=${HTTPS_PROXY}
      - NO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.${COMPOSE_PROJECT_NAME}_default
      - http_proxy=${HTTP_PROXY}
      - https_proxy=${HTTPS_PROXY}
      - no_proxy=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.${COMPOSE_PROJECT_NAME}_default
  icinga2-web:
    ...
    environment:
      - HTTP_PROXY=${HTTP_PROXY}
      - HTTPS_PROXY=${HTTPS_PROXY}
      - NO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.${COMPOSE_PROJECT_NAME}_default
      - http_proxy=${HTTP_PROXY}
      - https_proxy=${HTTPS_PROXY}
      - no_proxy=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.${COMPOSE_PROJECT_NAME}_default

• 通过COMPOSE_PROJECT_NAME环境变量自动匹配当前项目的网络域名后缀，无需手动指定网络名

3. 确保容器内代理客户端支持CIDR #

部分基础镜像（如alpine）的curl等工具默认不支持CIDR格式的no_proxy，可采取以下措施：

• 安装libproxy扩展以支持CIDR规则
• 直接在no_proxy中添加具体的容器IP段前缀（如172.30.0.0/24）
• 替换为支持CIDR的代理客户端工具

内容的提问来源于stack exchange，提问作者FreeSoftwareServers