Pulling models from behind firewall not possible even though pulling images works

[holger-stenzhorn]

I am running Docker Engine on a Rocky Linux VM behind a firewall and therefore I have provided a proxy configuration in /etc/systemd/system/docker.service.d/http-proxy.conf:

[Service]
Environment="HTTP_PROXY=http://some.proxy.server:3128"
Environment="HTTPS_PROXY=http://some.proxy.server:3128"
Environment="NO_PROXY=localhost,127.0.0.1"

With this configuration pulling of images works BUT pulling of models does not:

❯ docker model run ai/smollm2
353d9a3ec7ee: Pull complete Digest: sha256:00fba948428db7f9a750a7a74b3af55ab99801d0a6f1a1d7b68169a948661342
Status: Downloaded newer image for docker/model-runner:latest

Successfully pulled docker/model-runner:latest
Starting model runner container docker-model-runner...
Unable to find model 'ai/smollm2' locally. Pulling from the server.
Failed to pull model: pulling ai/smollm2 failed with status 500 Internal Server Error: error while pulling model: reading model from registry: failed to pull model "ai/smollm2": UNKNOWN - Get "https://index.docker.io/v2/": net/http: TLS handshake timeout

So seemingly the proxy configuration is not passed to the container docker-model-runner but there is also no possibility to manually specify it.

[xenoscopic]

Thanks for filing the report!

@thaJeztah do you know if there's an easy way for us to pass the Docker Engine HTTP proxy setting into our model runner container in Docker CE? I guess we could bind-mount / parse http-proxy.conf, but I don't know if the permissions / ownership on that file would allow it. Our other option would probably be adding a --proxy flag to docker model install-runner, but it would be nice from an integration standpoint if it could be inherited from dockerd's config.