Configure a SOCKS5 Proxy for Azure Blob’s Python Client

Configure the supplied Requests Session itself, then keep its lifetime outside the synchronous Blob client with session_owner=False.

import requests
from azure.core.pipeline.transport import RequestsTransport
from azure.storage.blob import BlobServiceClient

with requests.Session() as session:
    session.trust_env = False
    session.proxies["https"] = "socks5h://proxy.example:1080"
    transport = RequestsTransport(session=session, session_owner=False)
    with BlobServiceClient(
        account_url=account_url,
        credential=credential,
        transport=transport,
    ) as client:
        pass

Perform the intended Blob operation in place of pass, using the application's account_url and credential. Requests' optional SOCKS dependencies must already be present. socks5h delegates destination DNS to the proxy. For a publicly reachable Blob endpoint where public intermediaries are permitted, the SOCKS5 proxy list supplies candidates for the session’s proxy URL.

Set trust_env on this Session to control Requests’ environment integration. RequestsTransport applies its environment initialization when it creates a session, not when given an existing one. The explicit false value prevents proxy environment inputs from replacing this route.

That choice also disables environment-based CA selection. If needed, supply connection_verify="/path/to/ca-bundle.pem" to RequestsTransport, with roots required for the actual service.

The Blob client closes before the outer Session context. session_owner=False leaves ownership with that outer block. A token credential created separately can have another HTTP transport; configure it too if its acquisition needs SOCKS.

Related articles