Docker Proxy Credentials: URL Encoding and systemd Percent Escapes
Percent-encode proxy credential components, then preserve those percent signs through a systemd Environment assignment.
A domain-style proxy username can contain a backslash, and a password can contain characters reserved by URI syntax. Encode those credential components when building the proxy URL: a backslash becomes %5C, for example.
A systemd service Environment assignment adds another parser. Literal percent signs in the unit configuration need doubling:
[Service]
Environment="HTTPS_PROXY=http://DOMAIN%%5Cproxy-user:example%%[email protected]:8080"The illustrative values represent a domain username and a password containing #. systemd turns %% into %, leaving the encoded URL for the daemon. Add the corresponding HTTP_PROXY assignment if that destination scheme also needs the route.
The double percent is systemd syntax. Docker’s daemon.json proxy value instead contains the ordinary URI escapes, such as %5C and %23. Do not copy the unit-file spelling unchanged into JSON or a client’s proxy URL field.
Keep the configured source in view too. Docker documents daemon proxy configuration as taking precedence over proxy environment variables; an older JSON value can therefore hide a corrected service environment.