buildx fails to build extended Dockerfile for devcontainer features due to DeadlineExceeded on podman

• VSCode Version: 1.101.1
• Local OS Version: Win 11
• Remote OS Version: latest wsl2
• Remote Extension/Connection Type: Dev Containers/WSL/Remote - Tunnels/VS Code Server
• Container Engine: Podman
• Logs:
  log.txt

I'm trying to build an arbitrary devcontainer with added "hello" feature, i.e.,

    "features": {
        "ghcr.io/devcontainers/feature-starter/hello:1": {
            "greeting": "Hello"
        }

Without the feature, the image works.

I think the most important section is this:

[2025-06-20T22:43:45.775Z] Dockerfile.extended:1
--------------------
   1 | >>> # syntax=docker/dockerfile:1.4
   2 |     ARG _DEV_CONTAINERS_BASE_IMAGE=placeholder
   3 |     
--------------------
ERROR: failed to solve: DeadlineExceeded: DeadlineExceeded: failed to resolve source metadata for docker.io/docker/dockerfile:1.4: failed to do request: Head "https://registry-1.docker.io/v2/docker/dockerfile/manifests/1.4": dial tcp 98.85.153.80:443: i/o timeout
[2025-06-20T22:43:45.780Z] Stop (30343 ms): Run: docker buildx build --load --build-context dev_containers_feature_content_source=/tmp/devcontainercli-root/container-features/0.77.0-1750459393610 --no-cache --build-arg _DEV_CONTAINERS_BASE_IMAGE=<gitlab_url>/zephyr-docker-image/5-add-polyspace-platform/polyspace:b04229945d1dd4d8d74079b82c6bcf1d110f1fd2 --build-arg _DEV_CONTAINERS_IMAGE_USER=root --build-arg _DEV_CONTAINERS_FEATURE_CONTENT_SOURCE=dev_container_feature_content_temp --target dev_containers_target_stage -f /tmp/devcontainercli-root/container-features/0.77.0-1750459393610/Dockerfile.extended -t vsc-zephyr-demo-project-ef37398b43aa503131e5aab09377f6a7b427da4781019c7752aec70cb26110ba-features /tmp/devcontainercli-root/empty-folder

But curl https://registry-1.docker.io/v2/docker/dockerfile/manifests/1.4 works and so does docker pull docker/dockerfile:1.4. So what metadata exactly is docker trying to pull? How to test it with curl?

Steps to Reproduce:

1. create devcontainer helper image (localhost/vsc-volume-bootstrap:latest ) and "login" via docker exec -it a85bb21cf762 /bin/sh (adjust the id)
2. create Dockerfile with content:

 # syntax=docker/dockerfile:1.4
 FROM ubuntu

2. run docker buildx build .

Result:

/tmp # docker buildx build .
[+] Building 30.1s (2/2) FINISHED                                                                                 docker-container:default
 => [internal] load build definition from Dockerfile                                                                                  0.0s
 => => transferring dockerfile: 80B                                                                                                   0.0s
 => ERROR resolve image config for docker-image://docker.io/docker/dockerfile:1.4                                                    30.0s
------
 > resolve image config for docker-image://docker.io/docker/dockerfile:1.4:
------
WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
Dockerfile:1
--------------------
   1 | >>> # syntax=docker/dockerfile:1.4
   2 |     FROM ubuntu
   3 |
--------------------
ERROR: failed to solve: DeadlineExceeded: DeadlineExceeded: failed to resolve source metadata for docker.io/docker/dockerfile:1.4: failed to do request: Head "https://registry-1.docker.io/v2/docker/dockerfile/manifests/1.4": dial tcp 98.85.153.80:443: i/o timeout

I'm behind a ZScaler proxy, but *.docker.io is whitelisted, otherwise no pulls would work I guess. Also, curl https://registry-1.docker.io/v2/docker/dockerfile/manifests/1.4 "works" (no timeout):

$ curl https://registry-1.docker.io/v2/docker/dockerfile/manifests/1.4
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"docker/dockerfile","Action":"pull"}]}]}

So what's exactly is going on, which metadata and where is buildx trying to pull from?

Environment:

Podman Desktop,

 podman version
Client:       Podman Engine
Version:      5.5.1
API Version:  5.5.1
Go Version:   go1.24.3
Git Commit:   850db76dd78a0641eddb9ee19ee6f60d2c59bcfa
Built:        Thu Jun  5 23:49:19 2025
OS/Arch:      windows/amd64

Server:       Podman Engine
Version:      5.5.1
API Version:  5.5.1
Go Version:   go1.23.9
Git Commit:   850db76dd78a0641eddb9ee19ee6f60d2c59bcfa
Built:        Thu Jun  5 02:00:00 2025
OS/Arch:      linux/amd64

Edit, found the problem, but not a solution:
It is a proxy problem. Seems that buildkit does not use proxy variables neither from ./docker/config.json, nor from the environment variables.

See https://github.com/docker/buildx/issues/136 and https://github.com/docker/buildx/issues/191 and https://github.com/docker/setup-buildx-action/issues/57 and https://github.com/moby/buildkit/issues/971

Fixing the issue requires to create a new builder that respects my env vars:

/ # docker buildx create --name no_proxy
no_proxy

/ # docker buildx create --driver-opt env.HTTPS_PROXY=$HTTPS_PROXY --name with_proxy
with_proxy

/ # docker buildx --builder no_proxy build .
[+] Building 33.2s (3/3) FINISHED                                                                                                                                 docker-container:no_proxy
 => [internal] booting buildkit                                                                                                                                                        2.9s
 => => pulling image moby/buildkit:buildx-stable-1                                                                                                                                     2.3s
 => => creating container buildx_buildkit_no_proxy0                                                                                                                                    0.6s
 => [internal] load build definition from Dockerfile                                                                                                                                   0.1s
 => => transferring dockerfile: 82B                                                                                                                                                    0.0s
 => ERROR [internal] load metadata for docker.io/library/ubuntu:latest                                                                                                                30.0s
------
 > [internal] load metadata for docker.io/library/ubuntu:latest:
------
WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
Dockerfile:2
--------------------
   1 |      # syntax=docker/dockerfile:1.4
   2 | >>>  FROM ubuntu
   3 |
--------------------
ERROR: failed to solve: DeadlineExceeded: DeadlineExceeded: ubuntu: failed to resolve source metadata for docker.io/library/ubuntu:latest: failed to do request: Head "https://registry-1.docker.io/v2/library/ubuntu/manifests/latest": dial tcp 3.94.224.37:443: i/o timeout


/ # docker buildx --builder with_proxy build .
[+] Building 5.3s (5/5) FINISHED                                                                                                                                docker-container:with_proxy
 => [internal] booting buildkit                                                                                                                                                        2.8s
 => => pulling image moby/buildkit:buildx-stable-1                                                                                                                                     2.2s
 => => creating container buildx_buildkit_with_proxy0                                                                                                                                  0.6s
 => [internal] load build definition from Dockerfile                                                                                                                                   0.1s
 => => transferring dockerfile: 82B                                                                                                                                                    0.0s
 => [internal] load metadata for docker.io/library/ubuntu:latest                                                                                                                       2.2s
 => [internal] load .dockerignore                                                                                                                                                      0.0s
 => => transferring context: 2B                                                                                                                                                        0.0s
 => [1/1] FROM docker.io/library/ubuntu:latest@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f                                                                 0.1s
 => => resolve docker.io/library/ubuntu:latest@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f                                                                 0.0s
WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
/ #

So, what can I do? How do I move devcontainers to create a buildkit builder that respects my proxy vars?