Description
I’m seeing non-deterministic behavior in docker build where an explicit --build-arg no_proxy=... sometimes gets overridden by the proxy default from Docker client config.json (proxies.default.noProxy).
Repeating the same build command produces different results across runs.
Reproduce
# allow to override Docker client proxies if necessary
ARG http_proxy
ARG https_proxy
ARG no_proxy
FROM ubuntu:24.04
# redeclare ARGs
ARG http_proxy
ARG https_proxy
ARG no_proxy
RUN <<EOF
env | grep -i proxy
exit 1
EOF
$HOME/.docker/config.json
{
"proxies":
{
"default": {
"noProxy": "my_default_noproxy_value_from_config.json"
}
}
}Repeatedly run docker build --build-arg no_proxy="my_cmdline_value" .
Expected behavior
When a user explicitly passes a build-arg on the command line, it should always take precedence over proxy defaults coming from ~/.docker/config.json.
For example, running:
docker build --build-arg no_proxy="my_cmdline_value" .
should deterministically result in the build environment using:
no_proxy=my_cmdline_value and/orNO_PROXY=my_cmdline_value
and it should never be replaced by proxies.default.noProxy (e.g. my_default_noproxy_value_from_config.json), regardless of how many times the build is repeated.
docker version
Client: Docker Engine - Community
Version: 25.0.2
API version: 1.44
Go version: go1.21.6
Git commit: 29cf629
Built: Thu Feb 1 00:23:03 2024
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 25.0.2
API version: 1.44 (minimum version 1.24)
Go version: go1.21.6
Git commit: fce6e0c
Built: Thu Feb 1 00:23:03 2024
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.28
GitCommit: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
runc:
Version: 1.1.12
GitCommit: v1.1.12-0-g51d5e94
docker-init:
Version: 0.19.0
GitCommit: de40ad0
docker info
Client: Docker Engine - Community
Version: 25.0.2
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.12.1
Path: /usr/libexec/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.24.5
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 9
Server Version: 25.0.2
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
runc version: v1.1.12-0-g51d5e94
init version: de40ad0
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.8.0-94-generic
Operating System: Ubuntu 24.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 16
Total Memory: 15.25GiB
Name: galaxy-book2
ID: 4144eb0b-0084-4392-ac18-9c39ce54c05d
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: falseAdditional Info
Confirmed on 2 differents hosts, with 2 docker engines:(25.0.2 and 27.5.1)
Description
I’m seeing non-deterministic behavior in
docker buildwhere an explicit--build-arg no_proxy=...sometimes gets overridden by the proxy default from Docker clientconfig.json(proxies.default.noProxy).Repeating the same build command produces different results across runs.
Reproduce
$HOME/.docker/config.json{ "proxies": { "default": { "noProxy": "my_default_noproxy_value_from_config.json" } } }Repeatedly run
docker build --build-arg no_proxy="my_cmdline_value" .Expected behavior
When a user explicitly passes a build-arg on the command line, it should always take precedence over proxy defaults coming from
~/.docker/config.json.For example, running:
should deterministically result in the build environment using:
no_proxy=my_cmdline_valueand/orNO_PROXY=my_cmdline_valueand it should never be replaced by
proxies.default.noProxy(e.g.my_default_noproxy_value_from_config.json), regardless of how many times the build is repeated.docker version
Client: Docker Engine - Community Version: 25.0.2 API version: 1.44 Go version: go1.21.6 Git commit: 29cf629 Built: Thu Feb 1 00:23:03 2024 OS/Arch: linux/amd64 Context: default Server: Docker Engine - Community Engine: Version: 25.0.2 API version: 1.44 (minimum version 1.24) Go version: go1.21.6 Git commit: fce6e0c Built: Thu Feb 1 00:23:03 2024 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.6.28 GitCommit: ae07eda36dd25f8a1b98dfbf587313b99c0190bb runc: Version: 1.1.12 GitCommit: v1.1.12-0-g51d5e94 docker-init: Version: 0.19.0 GitCommit: de40ad0docker info
Additional Info
Confirmed on 2 differents hosts, with 2 docker engines:(
25.0.2and27.5.1)