buildkit can not use proxies

[Fire-Dragons]

Bug report

Bug description

BuildKit cannot use the proxies configured in Docker Desktop.

Reproduction steps

I cannot pull images directly and need to use a proxy.
When I configured proxies in Docker Desktop, account login and docker pull worked properly.
However, when I ran the docker build command, the following error occurred:

ERROR: failed to build: failed to solve: DeadlineExceeded: failed to fetch oauth token: Post "https://auth.docker.io/token": dial tcp 104.244.43.136:443: i/o timeout

After troubleshooting, I found that running the build with DOCKER_BUILDKIT=0 docker build worked as expected.

Platform

macOS

Version information

Client:
 Version:           29.1.3
 API version:       1.52
 Go version:        go1.25.5
 Git commit:        f52814d
 Built:             Fri Dec 12 14:48:46 2025
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.57.0 (215387)
 Engine:
  Version:          29.1.3
  API version:      1.52 (minimum version 1.44)
  Go version:       go1.25.5
  Git commit:       fbf3ed2
  Built:            Fri Dec 12 14:50:40 2025
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.2.1
  GitCommit:        dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
Client:
 Version:    29.1.3
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Docker AI Agent - Ask Gordon (Docker Inc.)
    Version:  v1.17.1
    Path:     /Users/fire/.docker/cli-plugins/docker-ai
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.30.1-desktop.1
    Path:     /Users/fire/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.0.1
    Path:     /Users/fire/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.47
    Path:     /Users/fire/.docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Docker Inc.)
    Version:  v0.2.0
    Path:     /Users/fire/.docker/cli-plugins/docker-desktop
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.31
    Path:     /Users/fire/.docker/cli-plugins/docker-extension
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     /Users/fire/.docker/cli-plugins/docker-init
  mcp: Docker MCP Plugin (Docker Inc.)
    Version:  v0.35.0
    Path:     /Users/fire/.docker/cli-plugins/docker-mcp
  model: Docker Model Runner (Docker Inc.)
    Version:  v1.0.6
    Path:     /Users/fire/.docker/cli-plugins/docker-model
  offload: Docker Offload (Docker Inc.)
    Version:  v0.5.40
    Path:     /Users/fire/.docker/cli-plugins/docker-offload
  pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
    Version:  v0.0.22
    Path:     /Users/fire/.docker/cli-plugins/docker-pass
  sandbox: Docker Sandbox (Docker Inc.)
    Version:  v0.6.0
    Path:     /Users/fire/.docker/cli-plugins/docker-sandbox
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/fire/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.19.0
    Path:     /Users/fire/.docker/cli-plugins/docker-scout

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 6
 Server Version: 29.1.3
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Discovered Devices:
  cdi: docker.com/gpu=webgpu
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.54-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 10
 Total Memory: 7.653GiB
 Name: docker-desktop
 ID: 9e09ac34-07a5-426b-b76d-d78191ca7eeb
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=unix:///Users/fire/Library/Containers/com.docker.docker/Data/docker-cli.sock
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables

Diagnostics ID

No response

[thompson-shaun]

Thanks for submitting this ticket @Fire-Dragons!

You've run into a known feature gap in how Desktop proxy settings interact with the embedded BuildKit.

BuildKit makes direct HTTP requests from the CLI to fetch OAuth tokens from registries (for security reasons). These CLI-side requests don't currently inherit Docker Desktop's proxy configuration, which is why docker pull works but docker build fails. Your workaround (DOCKER_BUILDKIT=0) works because the legacy builder routes everything through the daemon, which gets its proxy configuration from Desktop in the configuration you described.

This has been an active topic of discussion for a while (since 2022 😅):

• add system proxy config support for cli requests buildx#1487 - Proposed solution and discussion
• Docker Desktop proxy not being recognized when doing a build. buildx#1979 - Related issue

The challenge has been determining the right approach for how CLI-side proxy config should be managed (buildx-specific vs. broader Docker CLI integration).

I'll restart this discussion with the team 🙇

[Fire-Dragons]

感谢您提交这张工单！

你遇到了一个已知的功能漏洞，比如桌面代理设置与嵌入式 BuildKit 的交互。

BuildKit 直接从 CLI 发送 HTTP 请求，从注册表获取 OAuth 令牌（出于安全考虑）。这些CLI端请求目前不会继承Docker Desktop的代理配置，这也是它能用但失败的原因。你的变通方法（）之所以有效，是因为遗留构建器会把所有内容都路由到守护进程，守护进程的代理配置是从你描述的桌面配置中获得的。docker pull``docker build``DOCKER_BUILDKIT=0

这个话题已经讨论了一段时间（自2022 😅年以来）：

• 添加系统代理配置支持CLI请求 buildx#1487- 提出的解决方案与讨论
• 在构建过程中无法识别 Docker Desktop 代理。 BuildX#1979- 相关问题

挑战在于确定如何管理CLI端代理配置（无论是buildx专属还是更广泛的Docker CLI集成）。

我会和团队🙇重新开始讨论

So what should I do now? When I test the CI process locally, it doesn't affect the CI running on GitHub.