Under the Flex Consumption plan, the Oryx build process always runs inside Microsoft’s infrastructure and will not respect any HTTP_PROXY or HTTPS_PROXY settings you place in your Function App. Here we need to check every outbound request from the build container travels through the virtual network and then through the Bluecoat proxy before it reaches the public endpoints Oryx needs, such as mcr.microsoft.com, nuget.org or github.com.
- Because you already have VNet integration enabled, the Function App’s outbound traffic is automatically sent into the designated subnet. To capture that traffic, create a user-defined route on the same subnet where VNet integration is configured.
az network route-table create \
--name rt-to-proxy \
--resource-group MyResourceGroup \
--location eastus
az network route-table route create \
--resource-group MyResourceGroup \
--route-table-name rt-to-proxy \
--name default-route \
--address-prefix 0.0.0.0/0 \
--next-hop-type VirtualAppliance \
--next-hop-ip-address 10.0.1.4
az network vnet subnet update \
--resource-group MyResourceGroup \
--vnet-name MyVNet \
--name MySubnet \
--route-table rt-to-proxy
Once this route is associated with the subnet, any attempt by Oryx to fetch packages or images will flow into your VNet, be picked up by the route table, and be forwarded to your Bluecoat proxy appliance, which then sends it out to the internet. Make sure your Network Security Group allows the Function subnet to connect to the proxy over HTTPS (and HTTP if needed) and configure the Bluecoat appliance to permit outbound calls to the specific domains used by Oryx.
After you’ve applied these networking changes, simply redeploy the Function App with the usual publish command.
func azure functionapp publish <app_name>
The Oryx build will now fetch all its required artifacts through your corporate proxy without any further configuration in the Function App itself.
- If it’s impractical to open the proxy to every possible Oryx endpoint, you can bypass the in-Azure build step entirely by preparing your deployment package ahead of time. Build and package your app locally (or in a CI/CD agent) and then publish with:
func azure functionapp publish <app_name> --no-build
Alternatively, containerize the function.
docker build -t myfunctions:latest .
docker tag myfunctions:latest <yourACR>.azurecr.io/myfunctions:latest
docker push <yourACR>.azurecr.io/myfunctions:latest
Then configure the Function App to use that image from Azure Container Registry. Both approaches routing through your proxy or using a prebuilt package ensure that your corporate compliance requirements are met while keeping your deployment process smooth and reliable.
