fix: use BUILD_PROXY arg to avoid BuildKit proxy conflict

BuildKit intercepts HTTP_PROXY build args for image pulls, causing
host.docker.internal resolution failures. Use custom BUILD_PROXY arg
instead — Docker daemon's own proxy handles image pulls.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -11,11 +11,10 @@ CODEX_ARCH=arm64       # arm64/x64
 # ── Port ──
 PORT=8080
 
-# ── Docker proxy configuration ──
-# Build-time: used during `docker compose build` for npm/GitHub access
-# HTTP_PROXY=http://host.docker.internal:7897
-# HTTPS_PROXY=http://host.docker.internal:7897
+# ── Docker proxy ──
+# Build-time: proxy for npm install / GitHub downloads inside Docker build.
+# host.docker.internal refers to the Docker host machine.
+# BUILD_PROXY=http://host.docker.internal:7890
 
-# Runtime: container uses this proxy to reach chatgpt.com
-# Use host.docker.internal to reach a proxy on the Docker host
-# CONTAINER_PROXY=http://host.docker.internal:7897
+# Runtime: proxy for the container to reach chatgpt.com.
+# CONTAINER_PROXY=http://host.docker.internal:7890

Dockerfile

@@ -7,6 +7,12 @@ RUN apt-get update && \
 
 WORKDIR /app
 
+# Optional build-time proxy for npm/GitHub downloads inside RUN commands.
+# Uses custom arg name to avoid BuildKit intercepting HTTP_PROXY for image pulls.
+# Docker daemon's own proxy handles image pulls separately.
+ARG BUILD_PROXY
+ENV http_proxy=${BUILD_PROXY} https_proxy=${BUILD_PROXY}
+
 # Install backend dependencies (postinstall downloads curl-impersonate for Linux)
 COPY package*.json ./
 RUN npm ci
@@ -23,6 +29,9 @@ RUN npx tsc
 # Prune dev dependencies
 RUN npm prune --omit=dev
 
+# Clear build-time proxy from image
+ENV http_proxy= https_proxy=
+
 # Persistent data mount point
 VOLUME /app/data
 

docker-compose.yml

@@ -2,12 +2,10 @@ services:
   codex-proxy:
     build:
       context: .
-      # Pass host proxy to build stage (npm install, curl downloads)
-      # Set HTTP_PROXY in .env or shell environment
       args:
-        - HTTP_PROXY=${HTTP_PROXY:-}
-        - HTTPS_PROXY=${HTTPS_PROXY:-}
-        - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1}
+        # Proxy for RUN commands (npm install, curl downloads).
+        # host.docker.internal resolves to the Docker host's IP.
+        - BUILD_PROXY=${BUILD_PROXY:-}
     ports:
       - "${PORT:-8080}:8080"
     volumes:
@@ -17,7 +15,6 @@ services:
     environment:
       - NODE_ENV=production
       # Runtime proxy for upstream requests (chatgpt.com)
-      # Use host.docker.internal to reach host's proxy from container
       - HTTP_PROXY=${CONTAINER_PROXY:-}
       - HTTPS_PROXY=${CONTAINER_PROXY:-}
       - NO_PROXY=localhost,127.0.0.1