On this page
If the browser works but Git, npm, or Docker times out, identify which process makes the request first
Reaching GitHub in a browser proves only that the browser uses the system proxy. Git reads its own configuration and environment variables, npm also reads npmrc, and Docker Desktop and Docker Engine use separate background processes. If all three commands fail, each may still be using a different proxy entry point.
Run one command that reproduces each problem: git ls-remote https://github.com/git/git.git HEAD, npm ping, and docker pull hello-world. Record the exact error text.
Could not resolve host indicates a resolution problem, while Connection refused commonly means no process is listening on the local port. A TLS or certificate error cannot be fixed by increasing the timeout.
Which process actually initiates each request
| Tool | Common proxy sources | Result to inspect first |
|---|---|---|
| Git HTTPS | Git configuration or HTTP(S)_PROXY | git config and GIT_CURL_VERBOSE |
| npm | Environment variables, npmrc, and registry configuration | npm config get and npm ping |
| Docker Desktop | Desktop Proxies settings | Desktop logs and pull errors |
| Linux Docker Engine | dockerd daemon.json or the systemd environment | journalctl -u docker |
First confirm that something is actually listening on 127.0.0.1
In the Clash client, check mixed-port or the HTTP port; do not assume it is always 7890. On Windows, use netstat -ano. On macOS or Linux, use lsof or ss to inspect the port. If the port does not exist, every tool configuration will return connection refused.
Using curl with an explicit proxy to access a known HTTPS address is the smallest entry-point test. Once it succeeds, give the same port to Git or npm. If curl also fails, fix the client, node, or local firewall before changing permanent settings in all three tools.
# 将 7890 换成客户端显示的 HTTP 或 mixed 端口
curl -I -x http://127.0.0.1:7890 https://github.com
# Linux 查看监听
ss -lntp | grep 7890
# Windows 查看监听
netstat -ano | findstr :7890Run one temporary terminal test before writing anything to a startup file
HTTP_PROXY and HTTPS_PROXY apply only to programs launched from the current terminal that choose to read them. Set them temporarily in a new terminal, complete the git or npm test, and close the terminal to remove them naturally. If the result works, then decide whether to add them to a PowerShell Profile, .zshrc, or CI environment.
NO_PROXY should include localhost, 127.0.0.1, and intranet domains that need direct access. Sending every intranet request through Clash creates new problems for local development servers, company repositories, and communication between Docker containers.
export HTTP_PROXY=http://127.0.0.1:7890
export HTTPS_PROXY=http://127.0.0.1:7890
export NO_PROXY=localhost,127.0.0.1,.local
# PowerShell
$env:HTTP_PROXY="http://127.0.0.1:7890"
$env:HTTPS_PROXY="http://127.0.0.1:7890"For Git, inspect the configuration source before deciding whether to set or remove anything
git config --show-origin --get-regexp shows which file supplies a proxy setting. No output usually means Git has not stored a separate proxy; it is not a new error. If http.proxy left by an old client points to a closed port, Git may keep using the stale value even when the environment variables are correct.
When Git needs a fixed HTTPS proxy, save only the user-level http.proxy; when it does not, remove the setting with --unset-all. An SSH remote does not use Git's HTTP proxy. If [email protected] times out, check SSH and ProxyCommand separately, or switch to HTTPS temporarily for comparison.
git config --show-origin --get-regexp '(^http\..*proxy$|^remote\..*\.proxy$)'
# 需要固定代理时再写入
git config --global http.proxy http://127.0.0.1:7890
git ls-remote https://github.com/git/git.git HEAD
# 以后改回环境变量或直连时删除
git config --global --unset-all http.proxyAn npm timeout also requires distinguishing the proxy from the registry
The official npm configuration reads HTTP_PROXY and HTTPS_PROXY, and it may also store proxy, https-proxy, and registry in a user or project .npmrc. If registry points to a discontinued mirror, changing proxy nodes does not change the request address.
Run npm config get proxy, npm config get https-proxy, and npm config get registry, then use npm ping to verify the current registry. A .npmrc in the project directory can override user settings, so different projects may behave differently on the same computer.
If temporary environment variables already work, there is no need to save a fixed npm proxy as well. Set the two items below only after confirming that npm did not read the environment variables.
npm config get proxy
npm config get https-proxy
npm config get registry
npm ping
# 仅在确实需要 npm 固定代理时设置
npm config set proxy http://127.0.0.1:7890
npm config set https-proxy http://127.0.0.1:7890
npm ping
# 改回环境变量或直连时清理
npm config delete proxy
npm config delete https-proxydocker pull is initiated by the background engine, so changing the current shell may not help
Docker Desktop has its own proxy settings. On Windows or macOS, open Settings → Resources → Proxies in Docker Desktop and choose System proxy.
If the system proxy is not detected, choose Manual configuration and enter Clash's HTTP or mixed port.
Official Docker documentation states that Desktop does not read daemon proxy settings from daemon.json, so do not keep editing both locations.
On native Linux, Docker Engine uses dockerd to pull images. Check whether /etc/docker/daemon.json already exists, and merge the proxies field below into the existing JSON instead of replacing the whole file. After saving, validate the JSON and daemon configuration, then restart Docker.
Configuring a proxy for applications inside containers is separate; it does not fix docker pull operations performed by the daemon.
# 把 proxies 合并进现有 /etc/docker/daemon.json，不要覆盖其他字段
{
"proxies": {
"http-proxy": "http://127.0.0.1:7890",
"https-proxy": "http://127.0.0.1:7890",
"no-proxy": "localhost,127.0.0.1,.local"
}
}
sudo dockerd --validate --config-file=/etc/docker/daemon.json
sudo systemctl restart docker
docker info | grep -i proxy
docker pull hello-world- Docker Desktop
- In Settings → Resources → Proxies, check both Docker Desktop proxy and Containers proxy, then apply the settings and perform a clean pull of hello-world.
- Linux Docker Engine
- Validate daemon.json with dockerd --validate before restarting the service; if it fails, inspect journalctl -u docker.
- Running container
- Pass proxy variables only when a container needs internet access, and add the host and intranet addresses to NO_PROXY.
Inside WSL or a container, 127.0.0.1 refers to a different host
Clash on Windows listens on 127.0.0.1, but 127.0.0.1 inside WSL2 or a container refers to that environment itself. On a NAT network, use an address that can reach the host, confirm that the client allows LAN connections, and limit Windows Firewall access to only the required virtual subnet. Mirrored networking behaves differently, so verify against the current WSL network configuration.
From WSL or the container, first use curl to reach the host's proxy port. If the port itself is unreachable, changing Git or npm is pointless. Once the port works, decide whether to use environment variables or let Clash TUN capture these processes.
Once downloads work, keep only the layer you actually need
When environment variables, global Git configuration, npmrc, and Docker settings all coexist, later port changes or client shutdowns become difficult to explain. Keep the one layer you actually use every day, remove fixed proxies created during testing, and document which commands depend on it.
Finally, run git ls-remote https://github.com/git/git.git HEAD, npm ping, and docker pull hello-world in that order from a new terminal. All three should succeed, and the corresponding requests should appear on the Clash connections page.
After exiting Clash, the tools should not keep pointing to the closed local port. If Connection refused still appears, continue removing stale fixed-proxy settings.