PyCharm Remote Interpreter and Docker: DNS Resolution Conflicts with IDE Certificate Validation

Answer

When PyCharm Professional (2024.x) creates a Docker‑based remote interpreter, the IDE uses the host OS resolver to look up the Docker daemon’s hostname or IP address. After the daemon returns the container’s IP address, PyCharm communicates with the container directly via that IP, so no further name resolution is performed by the IDE for the interpreter channel.

Confirmed facts

1. DNS source for IDE‑to‑daemon traffic: host OS resolver (or manual /etc/hosts entry).
   Verification: capture DNS queries on port 53 while PyCharm starts the interpreter (e.g., tcpdump -i any port 53 -w dns.pcap) and look for queries originating from the IDE process.
2. Post‑start communication: IDE talks to the container using the IP address obtained from the Docker API; the container’s own DNS settings (daemon.json, network‑specific --dns, or /etc/resolv.conf) are used only by processes inside the container (pip, conda, the Python interpreter).
3. Certificate validation: PyCharm’s HTTP client (Java’s HttpsURLConnection) validates HTTPS connections against the IDE’s configurable trust store (Settings ► Build, Execution, Deployment ► Certificates). This covers IDE‑initiated traffic such as plugin repositories, update checks, and any package index accessed directly from the IDE.
   Processes running inside the container use the container’s CA bundle or system trust store; they are not validated by the IDE trust store unless the container’s store is updated.
4. Per‑project DNS override: PyCharm provides no GUI or per‑project setting to supply a custom DNS server or hosts file for its HTTP client. DNS resolution for IDE‑originated traffic relies solely on the host OS resolver (or host‑level /etc/hosts).

Recommended steps for your setup

1. Ensure the Docker daemon’s hostname or IP is resolvable on the host (add to /etc/hosts or configure host DNS) so PyCharm can start the container.
2. Import the corporate proxy’s self‑signed certificate into PyCharm’s trust store (Settings ► Build, Execution, Deployment ► Certificates ► Trusted Certificates). This secures IDE‑initiated HTTPS traffic to the internal package index if the IDE accesses it directly.
3. If the internal package index is accessed only by pip or conda running inside the container, also add the certificate to the container’s CA bundle (e.g., copy to /usr/local/share/ca-certificates/ and run update-ca-certificates) or set REQUESTS_CA_BUNDLE/PIP_CERT environment variables.
4. Verify container DNS: after the container is running, run docker inspect --format='{{json .HostConfig.Dns}}' <container-id> or docker exec <container> cat /etc/resolv.conf to confirm it points to your custom DNS server.
5. Optional verification: examine idea.log for lines containing "Connecting to docker daemon" or "Resolving host" to confirm host‑side name resolution.

Missing diagnostic detail

To decide whether the host’s DNS (and thus the IDE trust store) is sufficient, please confirm: Is the internal package index accessed directly by PyCharm (e.g., via the IDE’s Packages UI) or only by pip/conda inside the container? If the IDE accesses it directly, host DNS and the IDE trust store must be correct; if only the container accesses it, you must ensure the container’s DNS and trust store are configured.