无法直接访问外部网络时，除了Host自己的全局代理设置之外，需要单独给Docker Client和Instance设置代理。

如执行docker run时遇到下面的错误

docker: Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp 3.216.34.172:443: i/o timeout.
See 'docker run --help'.

可以通过修改Docker仓库和代理配置

修改Docker仓库 

/etc/docker/daemon.json

# vi /etc/docker/daemon.json
# cat daemon.json
{"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn","https://hub-mirror.c.163.com","https://mirror.baidubce.com"]
}

修改Docker Client代理配置 

/etc/systemd/system/docker.service.d/proxy.conf

# vi /etc/systemd/system/docker.service.d/proxy.conf
# cat proxy.conf
[Service]
Environment="HTTP_PROXY=http://IP:Port/"
Environment="HTTPS_PROXY=http://IP:Port/"
Environment="NO_PROXY=https://registry-1.docker.io/v2/"

修改Docker Instance代理配置 

~/.docker/config.json

[xxx]# cat ~/.docker/config.json
{"proxies":{"default":{"httpProxy": "http://IP:Port/","httpsProxy": "http://IP:Port/","noProxy": "127.0.0.0/8"}}
}

或者在启动Docker时添加环境变量参数

--env HTTP_PROXY="http://IP:Port"

--env HTTPS_PROXY="https://IP:Port"

--env FTP_PROXY="ftp://IP:Port"

--env NO_PROXY="127.0.0.0/8"