diff --git a/docker-compose.yml b/docker-compose.yml
index b04c1f6..638169b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,3 +1,15 @@
+# you may need to add to this list if containers need to have internet access
+# AND talk to other containers.
+x-no-proxy: &no-proxy localhost
+
+x-proxy-common: &proxy-common
+  HTTP_PROXY: ${HTTP_PROXY:-}
+  http_proxy: ${http_proxy:-}
+  HTTPS_PROXY: ${HTTPS_PROXY:-}
+  https_proxy: ${https_proxy:-}
+  NO_PROXY: *no-proxy
+  no_proxy: *no-proxy
+
 services:
   waveform-controller:
     build:
@@ -5,10 +17,7 @@ services:
       dockerfile: waveform-controller/Dockerfile
       target: waveform_controller
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     # ideally we'd use docker secrets but it's not enabled currently
     env_file:
      - ../config/controller.env
@@ -21,10 +30,7 @@ services:
       dockerfile: waveform-controller/Dockerfile
       target: waveform_exporter
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
         # Set to 1 in integration tests so COVERAGE_PROCESS_START can collect data.
         # Default 0 keeps production/dev images free of the coverage package.
         INSTALL_COVERAGE: ${INSTALL_COVERAGE:-0}
@@ -45,15 +51,15 @@ services:
       target: hasher_api
       args:
         PIXL_PACKAGE_DIR: hasher
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     ports:
       # this is only here as a convenience for testing, we don't actually use it from the exporter
       - "127.0.0.1::8000"
     env_file:
       - ../config/hasher.env
+    environment:
+      # hasher needs access to key vaults at run time
+      <<: *proxy-common
     restart: unless-stopped
   waveform-monitoring:
     # This service exists as a partly temporary measure, covering a few different cases:
@@ -65,10 +71,7 @@ services:
       context: .
       dockerfile: monitoring/Dockerfile
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     env_file:
       - ../config/monitoring.env
     volumes: