Why does my flag work locally but not in Docker?

Your code did not change between the two runs. The difference is in what reaches the process, and it comes down to a missing key or a blocked route almost every time.

Either one ends with an empty flag snapshot, and an empty snapshot means every call returns the default value you passed. That is the fail-safe behavior you want in production. It also makes local and containerized runs diverge without ever raising an error.

Check the key first

Usually your shell has the key and the container does not.

# On the host: the key is in your shell or a local env file
echo $FEATUREFLIP_SDK_KEY   # sdk_server_...

# In the container: nothing was passed through
docker compose exec api sh -c 'echo "[$FEATUREFLIP_SDK_KEY]"'   # []

A local env file that your dev server loads automatically stays invisible to a container unless your compose file passes it through. Log the key’s prefix at startup, never the key itself, and you will catch this in seconds without opening a single configuration file.

While you are there, confirm it is the right kind of key. A server key sees every flag in the project, a client key sees only the flags explicitly marked client-side visible. Container work often involves moving evaluation from a browser to a backend or the reverse, and the key needs to move with it.

Then check outbound access

A container attached only to an internal network cannot reach the evaluation endpoint. The SDK will keep retrying and keep serving defaults in the meantime.

Confirm from inside the container, not from the host, since the container’s namespace is the one that matters. If your environment requires an egress proxy, the SDK’s HTTP client needs to know about it, and a long-lived streaming connection needs a proxy that does not buffer responses.

The third possibility

If both check out, compare which environment each run is pointed at. A development key and a production key are different keys, and a flag enabled in one is often disabled in the other. There is a separate answer on why one key cannot serve every environment if that is where you have landed.

Whichever of the three it turns out to be, the reason you got no error is the same. Reliability covers why an empty snapshot is treated as a survivable state instead of a fault.