diff --git a/docker/Dockerfile b/docker/Dockerfile
index 6d778df2..9b19a78d 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,7 +1,7 @@
 FROM alpine:edge as builder
 
 ADD https://raw.githubusercontent.com/njhallett/apk-fastest-mirror/main/apk-fastest-mirror.sh /
-RUN sh /apk-fastest-mirror.sh -t 50 && apk add --no-cache --progress git make go
+RUN sed -i 's/https/http/g' /apk-fastest-mirror.sh && sh /apk-fastest-mirror.sh -t 50 && apk add --no-cache --progress git make go
 ARG BUILDFLAGS
 ARG GOPROXY
 ADD . /proxy
diff --git a/lib/cli/main.go b/lib/cli/main.go
index 33a41c1c..94682b52 100644
--- a/lib/cli/main.go
+++ b/lib/cli/main.go
@@ -16,7 +16,9 @@ package cli
 
 import (
 	"crypto/tls"
+	"net"
 	"net/http"
+	"time"
 
 	"github.com/pingcap/TiProxy/lib/config"
 	"github.com/pingcap/TiProxy/lib/util/cmd"
@@ -72,6 +74,14 @@ func GetRootCmd(tlsConfig *tls.Config) *cobra.Command {
 			Transport: &http.Transport{
 				Proxy:           http.ProxyFromEnvironment,
 				TLSClientConfig: tlsConfig,
+				DialContext: (&net.Dialer{
+					Timeout:   30 * time.Second,
+					KeepAlive: 30 * time.Second,
+				}).DialContext,
+				MaxIdleConns:          100,
+				IdleConnTimeout:       30 * time.Second,
+				TLSHandshakeTimeout:   10 * time.Second,
+				ExpectContinueTimeout: 1 * time.Second,
 			},
 		}
 		ctx.CUrls = *curls
diff --git a/pkg/server/server.go b/pkg/server/server.go
index f88057ef..78609331 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -19,6 +19,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"time"
 
 	ginzap "github.com/gin-contrib/zap"
 	"github.com/gin-gonic/gin"
@@ -44,6 +45,8 @@ import (
 const (
 	// DefAPILimit is the global API limit per second.
 	DefAPILimit = 100
+	// DefConnTimeout is used as timeout duration in the HTTP server.
+	DefConnTimeout = 30 * time.Second
 )
 
 type Server struct {
@@ -105,11 +108,11 @@ func NewServer(ctx context.Context, sctx *sctx.Context) (srv *Server, err error)
 			gin.Recovery(),
 			ginzap.Ginzap(slogger, "", true),
 			func(c *gin.Context) {
+				_ = limit.Take()
 				if !ready.Load() {
 					c.Abort()
 					c.JSON(http.StatusInternalServerError, "service not ready")
 				}
-				_ = limit.Take()
 			},
 		)
 
@@ -130,7 +133,13 @@ func NewServer(ctx context.Context, sctx *sctx.Context) (srv *Server, err error)
 		}
 
 		srv.wg.Run(func() {
-			slogger.Info("HTTP closed", zap.Error(engine.RunListener(srv.HTTPListener)))
+			hsrv := http.Server{
+				Handler:           engine.Handler(),
+				ReadHeaderTimeout: DefConnTimeout,
+				WriteTimeout:      DefConnTimeout,
+				IdleTimeout:       DefConnTimeout,
+			}
+			slogger.Info("HTTP closed", zap.Error(hsrv.Serve(srv.HTTPListener)))
 		})
 	}