docker buildx proxy again

[juju4]

I found many resources online but in the end proposed solutions didn't work in my setup which I believe is current to latest version or nearly (0.36.0 vs 0.37.0 just released)
How to make it work and why past shared flag give me all unknow flag?

https://stackoverflow.com/questions/73210141/running-buildkit-using-docker-buildx-behind-a-proxy
#136
#947
#1487

$ docker buildx build --progress plain --tag localhost/ubuntu:24.04 --driver-opt env.https_proxy=http://app_runner:REDACTED@192.168.1.2:3128 -- /var/lib/forgejo-runner/images/ubuntu
unknown flag: --driver-opt

Usage:  docker buildx build [OPTIONS] PATH | URL | -

Run 'docker buildx build --help' for more information

forgejo_runner@mlrun001:~$ docker buildx version
github.com/docker/buildx v0.36.1 1d8dde89b8aba914e05e45366770736fea1fd690
forgejo_runner@mlrun001:~$ docker version
Client: Docker Engine - Community
 Version:           29.7.2
 API version:       1.55
 Go version:        go1.26.5
 Git commit:        a7dcaa6
 Built:             Wed Aug  5 18:28:53 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.7.2
  API version:      1.55 (minimum version 1.40)
  Go version:       go1.26.5
  Git commit:       6a43e3d
  Built:            Wed Aug  5 18:28:53 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.3.3
  GitCommit:        aad11006b869517fcd3009450b6f82da282e1a9b
 runc:
  Version:          1.4.3
  GitCommit:        v1.4.3-0-gbb14dabe
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.4 LTS
Release:	24.04
Codename:	noble
$ docker buildx build --progress plain --tag localhost/ubuntu:24.04 --build-args HTTPS_PROXY=http://app_runner:REDACTED@192.168.1.2:3128 -- /var/lib/forgejo-runner/images/ubuntu
unknown flag: --build-args

Usage:  docker buildx build [OPTIONS] PATH | URL | -

Run 'docker buildx build --help' for more information

$ docker buildx build --progress plain --tag localhost/ubuntu:24.04 --config test.json -- /var/lib/forgejo-runner/images/ubuntu
unknown flag: --config

Usage:  docker buildx build [OPTIONS] PATH | URL | -

Run 'docker buildx build --help' for more information

$ dig production.cloudfront.docker.com +short
d3ipk8a4rcghwr.cloudfront.net.
108.138.36.59
108.138.36.26
108.138.36.70
108.138.36.43
[proxy set in env]
$ curl https://production.cloudfront.docker.com
<?xml version="1.0" encoding="UTF-8"?><Error><Code>MissingKey</Code><Message>Missing Key-Pair-Id query parameter or cookie value</Message></Error>
 docker buildx build --progress plain --tag localhost/ubuntu:24.04 -- /var/lib/forgejo-runner/images/ubuntu
#0 building with "default" instance using docker driver

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 965B done
#1 DONE 0.0s

#2 [internal] load metadata for docker.io/library/ubuntu:24.04
#2 ERROR: failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://production.cloudfront.docker.com/registry-v2/docker/registry/v2/blobs/sha256/a6/a6f81fb630d51837271b89f8193810a5fc493fa4f30a55d7ebcdb3a66f3cc63a/data?Expires=1788639662&Signature=GeiG5BesyYWRaqb0fkwcMPCyy0KkHeNUtPMWUIUTu14-42O0i8ddXTiSNGodgt~Q~XInLwEb~4AVDeteguIlYwDPoriRPNoUra0Lqk9XcoWA~HZL2Wq6YKJnemyi-6Vh4vpt5TpLV--QV0xF3rH0xvlX8UrrjO5YMOJ8t0Ug7fo0w5pRLGPGiWeEdd4Y~ZJbMMV-CBgJAxNNccFgVYSz56YoAwRnUd~5YZsHjNmF5YX04BsEiGoGv-zXX1C0NMNT1GQ9bSGpCaNSKXL2BHqtyHeVG24gvK9la2F5EyKzqE8dX4rCwcx8scZ834ZNbs7GgVApxjFmhLeodq-4kz8P1Q__&Key-Pair-Id=K2C9XPB6FLAKUF": Proxy Authentication Required
------
 > [internal] load metadata for docker.io/library/ubuntu:24.04:
------
Dockerfile:1
--------------------
   1 | >>> FROM ubuntu:24.04
   2 |     
   3 |     RUN apt-get update &&  \
--------------------
ERROR: failed to build: failed to solve: ubuntu:24.04: failed to resolve source metadata for docker.io/library/ubuntu:24.04: failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://production.cloudfront.docker.com/registry-v2/docker/registry/v2/blobs/sha256/a6/a6f81fb630d51837271b89f8193810a5fc493fa4f30a55d7ebcdb3a66f3cc63a/data?Expires=1788639662&Signature=GeiG5BesyYWRaqb0fkwcMPCyy0KkHeNUtPMWUIUTu14-42O0i8ddXTiSNGodgt~Q~XInLwEb~4AVDeteguIlYwDPoriRPNoUra0Lqk9XcoWA~HZL2Wq6YKJnemyi-6Vh4vpt5TpLV--QV0xF3rH0xvlX8UrrjO5YMOJ8t0Ug7fo0w5pRLGPGiWeEdd4Y~ZJbMMV-CBgJAxNNccFgVYSz56YoAwRnUd~5YZsHjNmF5YX04BsEiGoGv-zXX1C0NMNT1GQ9bSGpCaNSKXL2BHqtyHeVG24gvK9la2F5EyKzqE8dX4rCwcx8scZ834ZNbs7GgVApxjFmhLeodq-4kz8P1Q__&Key-Pair-Id=K2C9XPB6FLAKUF": Proxy Authentication Required
$ docker buildx build --progress plain --tag localhost/ubuntu:24.04 --build-arg https_proxy=$https_proxy -- /var/lib/forgejo-runner/images/ubuntu
[...]
#2 ERROR: failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://production.cloudfront.docker.com/registry-v2/docker/registry/v2/blobs/sha256/a6/a6f81fb630d51837271b89f8193810a5fc493fa4f30a55d7ebcdb3a66f3cc63a/data?Expires=1788639771&Signature=K8ws7qbgL1ERuqPgPpa-RhO7c62h2ryc5YxdJK7J1mK6QxiQc2Uw0rM~W6VHMZxVd0rnY16ECHoJtptph3iJpn~Ei3GcOvYW5jo5ImYp~tdzwNiKugzS-UuRqHmXFQiyST43Xkd6n~uK9D4j5qv2TelMbLD~HAhAW6LnzQLWNFzdpPTgDCZzJ12RjjlxkOssrnjUht7dDNhimlTBqDzAod4VZiTNmU~MbaInZCADApSkLNjdDqHibZovQr9Cv~hINsIxTviIv~TKpEva8CofS2Mouhcwz8HYByBVCbRauI9WwWWFZWBQ8T4W3m~288HLfQsC7tN02opeFTVpywz0Lg__&Key-Pair-Id=K2C9XPB6FLAKUF": Proxy Authentication Required
[...]
$ DOCKER_BUILDKIT=0 docker buildx build --progress plain --tag localhost/ubuntu:24.04 --build-arg https_proxy=$https_proxy -- /var/lib/forgejo-runner/images/ubuntu
[same]

[Kxrma47]

The flags are being passed to the wrong subcommand: --driver-opt belongs to docker buildx create, the build flag is singular --build-arg, and build arguments cannot configure the builder's base-image pull. Create a proxied container builder instead:

docker buildx create --name proxied --driver docker-container \\
  --driver-opt env.HTTP_PROXY="$http_proxy" \\
  --driver-opt env.HTTPS_PROXY="$https_proxy" \\
  --driver-opt env.NO_PROXY="$no_proxy" --use --bootstrap
docker buildx build --progress=plain -t localhost/ubuntu:24.04 /var/lib/forgejo-runner/images/ubuntu

This matches the docker-container driver and buildx create documentation. If you keep the default docker driver, configure the proxy on the Docker daemon/BuildKit service and restart it (daemon proxy docs). A successful host curl only proves the host process has proxy access.

[juju4]

Thanks but that does not solve the issue

$ export https_proxy=http://app_runner:REDACTED@192.168.1.2:3128
$ docker buildx create --name proxied --driver docker-container   --driver-opt env.HTTP_PROXY="$http_proxy"   --driver-opt env.HTTPS_PROXY="$https_proxy" --use --bootstrap
[+] Building 0.0s (1/1) FINISHED                                                                                                          
 => ERROR [internal] booting buildkit                                                                                                0.0s
 => => pulling image moby/buildkit:buildx-stable-1                                                                                   0.0s
------
 > [internal] booting buildkit:
------
ERROR: Error response from daemon: Get "https://registry-1.docker.io/v2/": Proxy Authentication Required

On the proxy logs, the requests is not authenticated as it is supposed to be (407)
As said previously docker config has already proxy and works to pull image.
curl on its side reaches proxy and logged the right user.
I tried switching to a non-authenticated proxy (in systemd unit, environment, docker config.json, cli driver-opt) but still returning "Proxy Authentication required" but seeing no logs on either proxy from buildx... works normally if curl.
running with --debug does not provide more details like which proxy is used and where it is taken from.
~/.docker/buildx/instances/proxied, ~/.docker/config.json, /etc/environment, and forgejo runner systemd are matching new proxy.

[Kxrma47]

You're right — my previous command only configures the BuildKit container, but this failure occurs before that container exists. At [internal] booting buildkit, Buildx asks the selected Docker Engine to pull moby/buildkit:buildx-stable-1; --driver-opt env.* and ~/.docker/config.json cannot configure that daemon-side pull.

First isolate the path (please redact credentials from any output):

docker context show
docker context inspect "$(docker context show)" --format '{{json .Endpoints.docker.Host}}'
docker --context "$(docker context show)" pull moby/buildkit:buildx-stable-1
docker info | grep -E '[Pp][Rr][Oo][Xx][Yy]'
sudo systemctl show docker --property=Environment

If the explicit pull also returns 407, fix the proxy used by dockerd, not Buildx. On Engine 23+, put the authenticated, URL-encoded proxy under proxies.http-proxy / proxies.https-proxy in /etc/docker/daemon.json, then validate and restart:

sudo dockerd --validate --config-file=/etc/docker/daemon.json
sudo systemctl daemon-reload
sudo systemctl restart docker
docker pull moby/buildkit:buildx-stable-1

Note that daemon JSON/flags take precedence over systemd environment settings. In a systemd Environment= value, percent escapes must be doubled (for example %23 becomes %%23).

If the explicit pull succeeds but bootstrap still fails, force Buildx to use that same context and pre-pulled image:

ctx="$(docker context show)"
docker buildx rm -f proxied
docker buildx create "$ctx" --name proxied --driver docker-container \
  --driver-opt image=moby/buildkit:buildx-stable-1 --use --bootstrap

References: daemon proxy configuration, CLI proxy scope, and docker-container driver.