MatchHostName not allow Docker container hostnames

[sunnyphp]

Gitea Version

1.26.4

What happened?

You cannot import from disallowed hosts. Please ask the admin to check ALLOWED_DOMAINS/ALLOW_LOCALNETWORKS/BLOCKED_DOMAINS settings.

The error appears to be pinging the squid domain correctly from within the container:

/var/lib/gitea $ ping squid
PING squid (172.24.0.2): 56 data bytes
64 bytes from 172.24.0.2: seq=0 ttl=42 time=0.079 ms
^C

is not handled as a valid domain in Go.

Unfortunately, the error doesn't provide any details, nor does the source code I was trying to find the cause of the problem (there could be several possibilities, for example, here https://github.com/go-gitea/gitea/blob/main/services/migrations/migrate.go#L102 MatchHostName doesn't work correctly).

How are you running Gitea?

Gitea (gitea/gitea:1-rootless) docker compose:

    gitea1:
        image: gitea/gitea:1-rootless
        sysctls:
            net.ipv6.conf.all.disable_ipv6: 1
            net.ipv6.conf.default.disable_ipv6: 1
            net.ipv6.conf.lo.disable_ipv6: 1
        depends_on:
            squid:
                condition: service_healthy
        environment:
            # security settings (allow firewall usage)
            - GITEA__proxy__PROXY_ENABLED=true
            - GITEA__proxy__PROXY_URL=http://squid:3128
            - GITEA__proxy__PROXY_HOSTS=**
            - GITEA__migrations__ALLOWED_DOMAINS=squid
            - GITEA__migrations__ALLOW_LOCALNETWORKS=true
            # firewall variables
            - "HTTP_PROXY=http://squid:3128"
            - "HTTPS_PROXY=http://squid:3128"
            - "NO_PROXY=localhost,127.0.0.1"
        networks:
            - firewall
            - isolated-mysql
        labels:
            - "traefik.enable=true"
            - "traefik.docker.network=firewall"

(not important blocks skipped)

Squid docker compose:

    squid:
        sysctls:
            net.ipv6.conf.all.disable_ipv6: 1
            net.ipv6.conf.default.disable_ipv6: 1
            net.ipv6.conf.lo.disable_ipv6: 1
        ports:
            - 3128:3128/tcp
        networks:
            - access-to-internet
            - firewall
        labels:
            - "traefik.enable=true"
            - "traefik.docker.network=access-to-internet"

(not important blocks skipped, works as charm inside gitea1 container: /var/lib/gitea $ curl -I https://github.com and with other containers via environment variables like HTTP_PROXY and with firewall network)