Debugging Docker Container Traffic

Docker Desktop on macOS runs containers inside a Linux VM, so 127.0.0.1 inside a container means the container itself, not your Mac. Use Docker’s special DNS name for the host instead.

Point the container at the host proxy

docker run -e HTTP_PROXY=http://host.docker.internal:9090 \
           -e HTTPS_PROXY=http://host.docker.internal:9090 \
           your-image

Or in docker-compose.yml:

services:
  app:
    environment:
      HTTP_PROXY: http://host.docker.internal:9090
      HTTPS_PROXY: http://host.docker.internal:9090

host.docker.internal resolves to your Mac from inside any container without needing to know its LAN IP.

Trusting the CA inside the container

If the containerized app validates TLS certs strictly, it needs TonyProxy’s CA in its own trust store — mount the exported CA cert into the container and add it to the container’s CA bundle (update-ca-certificates on Debian/Ubuntu-based images, or the equivalent for your base image) at startup.

Not every process respects HTTP_PROXY

Same caveat as localhost debugging — some HTTP clients ignore proxy env vars entirely. If traffic still isn’t showing up, check whether your app’s networking library actually reads HTTP_PROXY/HTTPS_PROXY, or needs proxy configuration passed explicitly in code.