Turnstile works locally and fails in Docker

The symptom, as people actually report it

Two Stack Overflow questions describe it precisely, and neither has an accepted answer — which is the whole reason this page exists.

The first reports that curl_cffi with TLS impersonation works locally and returns 403 immediately in Docker, and that undetected-chromedriver clears the checkbox locally and enters an endless loop hosted — the element is found, clicked, and the challenge never completes. The second is a full Playwright browser: real Chromium, JavaScript running, a French locale and timezone set, navigator.webdriver hidden. It still gets 403 and a __cf_chl_rt_tk challenge parameter from Lambda.

That second case is the one worth sitting with. A complete browser with a real JavaScript engine did not help. Whatever is failing is not the absence of a JS runtime.

What Cloudflare actually documents

Two documented facts do most of the explaining, and one documented absence matters as much as either.

Fact one: IP reputation is an input to whether a challenge is issued. Cloudflare's troubleshooting page lists the sources of a challenge as high threat score, IP reputation, bot detection, WAF custom rules, Browser Integrity Check and Challenge Passage, and describes IP reputation as "If your IP has a history of suspicious activity, it may be flagged." Its remediation advice is blunt: "If your IP address has a poor reputation (often seen with shared VPNs or corporate proxies), try switching to a different, trusted network connection."

Fact two: Cloudflare's canonical example of a block rule is an ASN block on two cloud providers. In their own worked example for allowlisting around a mitigation, the scenario is "Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large volumes of undesired traffic, but allow Googlebot and other known bots that Cloudflare validates", with the expression (ip.src.asnum in {16509 15169} and not cf.client.bot). Site owners are shown how to do exactly the thing people run into.

The absence: Cloudflare's Turnstile documentation contains no statement about datacenter IPs, hosting providers or ASNs. Every file under the Turnstile and challenges documentation was searched for datacenter, data center, hosting provider, VPS, cloud provider and residential; the single hit is a generic sentence about excluding traffic by ASN, and it is in the challenges section, not Turnstile's. Anyone telling you Cloudflare documents a datacenter penalty for Turnstile is telling you something that is not in the documentation.

The other half: automation itself is unsupported

There is a second documented fact that most of these reports miss entirely, and it changes what "fix it" can even mean. Cloudflare's supported-browsers page lists unsupported environments, verbatim:

So the position is not that automation is difficult and might work with better flags. It is that solving a production challenge from Selenium, Puppeteer, Playwright or Cypress is outside what Cloudflare supports, and their documented answer for automated testing is the dummy sitekeys. A datacenter IP makes an unsupported path fail more reliably; it is not the sole reason it fails.

This is also why "it works locally" is a weaker signal than it feels like. A residential address with a good reputation buys enough margin for an unsupported client to pass anyway. Move the same client to an address with no such margin and the underlying situation stops being hidden.

How to tell which of the two you have

The failures look identical and have different fixes, so separate them before changing anything.

• Run the same code, from the server, through a residential proxy. One variable, and it is the one under suspicion. If it passes, the address is the dominant factor. If it still fails, the client is.
• Run a real headed browser on the server — Xvfb or a virtual display — rather than a headless one. If headed passes and headless does not on the same address, you are looking at automation detection rather than IP reputation.
• Check what you are actually being served. A 403 with a __cf_chl_rt_tk parameter is a challenge page, not a Turnstile widget, and the fix is different. Turnstile vs Cloudflare challenge separates them, and our checker will tell you which one a URL serves.
• Look for a loop rather than a refusal. Cloudflare documents challenge loops as happening "in very specific cases where we detect strong bot signals" — that is a detection outcome, not a network one. The verification loop page covers the causes that are yours to fix.

One anecdote from writing this page, offered because it is a cleaner demonstration than anything we could construct. Cloudflare's own community forum — the thread about being stuck in a Turnstile loop from Hetzner servers — returned 403 and a "Just a moment…" interstitial to a plain HTTPS request from the datacenter address this research ran on. The discussion about datacenter IPs failing challenges was itself unreachable from a datacenter IP.

What actually changes the outcome

In rough order of how much they move the needle, and with the honest cost of each:

If the target is your own property and the challenge is only in the way of a test, start at the top of that table. The test keys are deterministic, free, and specifically what Cloudflare tells you to use — most of the effort spent on this problem is spent solving a challenge that did not need to be there.

When the challenge does have to be cleared — staging behind a real widget, synthetic monitoring against your own production — the request is the same regardless of where your code runs, because the solve does not happen from your address. A sitekey and the page URL go in, a token comes back, and you submit it as cf-turnstile-response. Prepaid credits start at $0.40 per 1,000 solves and fall to $0.075 at volume; failed solves are never billed; the first 1,000 are free. The solve reference has the call.

Common questions

Related

Sources

• Cloudflare — supported browsers, including the unsupported-environments list
• Cloudflare — why a challenge is issued, and the AWS/GCP ASN example
• Cloudflare — bot scores and the detection engines
• Cloudflare — challenge loops
• Stack Overflow 79877820 — local works, Docker fails (1,034 views, no accepted answer)
• Stack Overflow 79997812 — Playwright on AWS Lambda (no answers)

More in Guides