Podman pull images behind a corporate proxy

Today, I set out to pull an image from Docker Hub on a RHEL 9 system using Podman. This step was part of my journey to install Watson Code Assistant for Z. While Podman is a great alternative to Docker on RHEL, the process had its quirks—especially when working with enterprise environments and specialized tools like Watson Code Assistant. In this post, I’ll share what worked, what didn’t, and some tips to make the setup smoother for anyone tackling the same challenge.

I can simulate the error using podman pull:

podman pull docker.io/library/orientdb:3.2.28

Trying to pull docker.io/library/orientdb:3.2.28…

WARN[0000] Failed, retrying in 1s ... (1/3). Error: initializing source docker://orientdb:3.2.28: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": read tcp 123.123.3.60:35924->98.90.233.146:443: read: connection reset by peer

WARN[0001] Failed, retrying in 1s ... (2/3). Error: initializing source docker://orientdb:3.2.28: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": read tcp 123.123.3.60:57270->52.2.233.225:443: read: connection reset by peer

WARN[0003] Failed, retrying in 1s ... (3/3). Error: initializing source docker://orientdb:3.2.28: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": read tcp 123.123.3.60:59134->3.93.227.105:443: read: connection reset by peer

Error: unable to copy from source docker://orientdb:3.2.28: initializing source docker://orientdb:3.2.28: pinging container registry registry-1.docker.io: Get "https://registry-1.docker.io/v2/": read tcp 123.24.3.60:57266->44.220.224.219:443: read: connection reset by peer

In most cases, the standard approach to enable image pulling behind a corporate proxy is to set the appropriate environment variables. This typically involves exporting your proxy settings like so:

export http_proxy="http://<proxy-host>:<proxy-port>" export https_proxy="http://<proxy-host>:<proxy-port>" export no_proxy="localhost,127.0.0.1"

The standard approach does not work, so i configure the proxy Globaly on RHEL 9

Create or edit the file /etc/environment (this affects all users and most services):

sudo vi /etc/environment

Add the following lines (replace with your actual proxy details):

http_proxy=“http://proxy.example.com:8080”
https_proxy=“http://proxy.example.com:8080”
ftp_proxy=“http://proxy.example.com:8080”

If your proxy requires authentication use these lines:
http_proxy=“http://username:password@proxy.example.com:8080”
https_proxy=“http://username:password@proxy.example.com:8080”

No-proxy (local networks, internal hosts) - very important!. Change the example bellow for your network

no_proxy=“localhost,127.0.0.1,::1,.example.com,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12”
NO_PROXY=“localhost,127.0.0.1,::1,.example.com,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12”

Save the file and source it:

source /etc/environment

podman pull docker.io/library/orientdb:3.2.28
Trying to pull docker.io/library/orientdb:3.2.28…
Getting image source signatures
Copying blob sha256:2d2472ac6840da0115175cae8b0be8d1b8c2b6b74acb5fc6bf185b0c9333b8a3
Copying blob sha256:9b076355b79badd38bc5732aebeb48133934a0adae078e4a6bf52c7d9d7a4a82
Copying blob sha256:0dde1d053504a51dc52d89eb36d703df02afbbc274b25ac00c02fe219e2d6f7c
Copying blob sha256:bd259c2f39c587be8bdd17660976c6158388173b58e226f2b5095d399cf658f2
Copying blob sha256:a22bcaede3cb82201c2804d7a050cbf18f994bd6f0b34f3ec133a47cc3c24ca9
Copying blob sha256:c050069391baee7bb13200b3297c944c954a22f0428769272d51e6cba8118a36
Copying blob sha256:42b80092d7e24557b10ea1e44542f6f887201fe9b56381a4a477cfbf9f2fc099
Copying config sha256:26cbda2db34c77dd8240b721da4177c6b43d6148f50d1ff15b81ce6c5c8869a9
Writing manifest to image destination
26cbda2db34c77dd8240b721da4177c6b43d6148f50d1ff15b81ce6c5c8869a9