In Dockerfile exec form, the JSON array is already the argument list:

CMD ["curl", "--noproxy", "*", "https://example.com/"]

Here curl receives --noproxy and * as separate arguments. The asterisk is not expanded into filenames because no command shell interprets this form.

Do not put the option and value into one JSON string. Nor should you add literal single quotes inside the string merely because a terminal example used them for shell protection. Those quote characters can become part of the value passed to the program.

Shell form has another boundary: it does involve a shell, so quoting and expansion rules matter there. An explicit shell launched from an exec-form command adds that boundary back.

curl's --noproxy * meaning is to bypass the proxy for all hosts. That is a routing choice, not a generic argument-format test. Use it only when a direct route is the intended policy. If you need a narrower bypass, supply the matching value in the same one-argument-per-element structure.

Allakkat attuumassuteqartut