Network mode "mirrored" causes proxy connection problems, relying on a specific startup sequence

[seventyseven007]

Windows Version

Windows 11 Professional Edition 26100.3775

WSL Version

2.5.9.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.6.87.2-1

Distro Version

Ubuntu 22.04.5 LTS

Other Software

When using WSL2 with the networkingMode=mirrored setting, pulling Docker images via a proxy tool (e.g., Clash) is heavily dependent on the startup order. If the proxy tool is started first and configured on port 127.0.0.1:7897, followed by Docker Desktop, the image pull fails with a connection refused error. However, if Docker Desktop is started first and then the proxy tool, the image pull succeeds. In NAT mode (default mode), the startup order does not affect the pull result. I have tested multiple proxy tools and various Docker Desktop versions, and the issue persists, confirming that it is not a problem with the proxy tools or Docker Desktop, but rather a potential bug in WSL2's mirrored network mode.

Repro Steps

Configure WSL2 to use mirrored network mode:
Edit C:\Users<YourUsername>.wslconfig:

[wsl2]
networkingMode=mirrored

Start a proxy tool (e.g., Clash) using the subscription URL and listen on 127.0.0.1:7897, enabling system proxy.
Start Docker Desktop.
Run the following command in the WSL2 terminal to pull an image:
docker pull friendica:rc-fpm
Expected Result: Image pull succeeds.
Actual Result: Error:
(HTTP code 500) server error - failed to resolve reference "docker.io/library/friendica:rc-fpm": failed to do request: Head "https://registry-1.docker.io/v2/library/friendica/manifests/rc-fpm": proxyconnect tcp: dial tcp 127.0.0.1:7897: connect: connection refused
Issue Description: The Docker Daemon fails to connect to registry-1.docker.io via the system proxy, receiving a connection refused error, indicating that WSL2 in mirrored mode fails to recognize the proxy port correctly.
Shut down Docker Desktop and the proxy tool, then repeat steps 2-4, starting Docker Desktop before the proxy tool.
Result: Image pull succeeds, and the proxy tool works normally.
Switch to NAT mode (remove networkingMode=mirrored or comment it out, add localhostForwarding=true), and repeat steps 2-4.
Result: Image pull succeeds regardless of startup order, with no impact from the proxy tool.

Expected Behavior

In mirrored network mode, pulling images via a proxy tool should not be affected by startup order. We hope WSL2 can fix the network initialization logic in mirrored mode to ensure proxy ports are accessible regardless of order.

Actual Behavior

(HTTP code 500) server error - failed to resolve reference "docker.io/library/redis:8.0.1": failed to do request: Head "https://registry-1.docker.io/v2/library/redis/manifests/8.0.1": proxyconnect tcp: dial tcp 127.0.0.1:7897: connect: connection refused

Diagnostic Logs

No response

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use collect-networking-logs.ps1, following the instructions here

Once completed please upload the output files to this Github issue.

Click here for more info on logging
If you choose to email these logs instead of attaching to the bug, please send them to wsl-gh-logs@microsoft.com with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'.

[seventyseven007]

When opening the proxy tool first and then opening docker dsektop, the WSL network log when the network image cannot be pulled through the proxy tool is displayed.

WslNetworkingLogs-2025-07-03_09-37-19.zip

First open docker desktop, then open the proxy tool. Now you can pull the corresponding image through the proxy tool's network. The corresponding WSL network logs

Here, the upload log failed because it was too large, so I uploaded it again through the log

This situation only occurs in WSL2's Mirrored network mode. Since I am in the mainland environment, I cannot access docker desktop without proxy tools. I hope the official can fix it as soon as possible.

[github-actions]

Diagnostic information

.wslconfig found
Detected appx version: 2.5.9.0
optional-components.txt not found

[seventyseven007]

/question

[github-actions]

Diagnostic information

Found '/question', adding tag 'question'

[micturkey]

I have this issue too.
However, no matter what the startup sequence is, I can never pull images in Docker Desktop or docker command in WSL.
But in WSL I can easily use the proxy except for docker.