What's in it

14 documents including this note, bringing the hub to 61:

Error catalogues: reference/functions/errors.md, reference/app-service/errors.md, reference/container-apps/errors.md, reference/container-registry/errors.md, reference/container-instances/errors.md, reference/vm/errors.md.
References: Functions hosting plans and host storage; App Service configuration and networking; Container Apps environments, ingress, revisions and scale.
Guides: a TypeScript function on Flex Consumption with no keys (Bicep); a Node.js TypeScript app on App Service for Linux with basic publishing off (Bicep).
Patterns: GitHub Actions to Container Registry to Container Apps with managed identities; a function app to its storage account without keys.

2026 changes captured

Functions: Flex Consumption is the default serverless plan; v3 apps on Linux Consumption stopped after September 30, 2026; Linux Consumption hosting retires September 30, 2028. Node.js 22 and 24 are the supported versions. Flex rejects many settings that older templates carry (FUNCTIONS_WORKER_RUNTIME, WEBSITE_RUN_FROM_PACKAGE, linuxFxVersion and more).
Azure CLI 2.91 az functionapp create always lists the storage keys and writes a connection string (read from its source), so apps meant to be keyless are created with Bicep.
Container Registry's ABAC role mode (AbacRepositoryPermissions): AcrPull, AcrPush and AcrDelete are ignored there; the Container Registry Repository Reader, Writer and Contributor roles apply.
App Service Premium V4 has no stable outbound IP addresses; outboundVnetRouting replaces vnetRouteAllEnabled.
VMs: Trusted Launch is the default for new Gen2 VMs from the portal, CLI and PowerShell; new virtual networks created with network API versions released after March 31, 2026 default to private subnets without default outbound access.
Bicep 0.48.1 types: Microsoft.Web has none after 2025-03-01; Container Apps 2026-07-01, Container Registry 2025-11-01, Container Instances 2026-07-01 and Compute 2026-04-01 do.

Sources were read from azure-docs@dd032389 (Functions, App Service, Container Apps, RBAC built-in roles), azure-compute-docs@c21e8e82 (VMs, Container Instances), azure-management-docs@af7b3831 (Container Registry), SupportArticles-docs@ff674f85 (Microsoft's troubleshooting articles, found to be public) and azure-rest-api-specs@c783b658.
All three Bicep files compile and lint clean with Bicep 0.48.1, and their parameter files build. Every TypeScript block type-checks under tsc --strict against @azure/functions 4.16.5. Every az command was checked against Azure CLI 2.91.0 help. Role definition IDs were checked against the built-in role reference.

App Service's container start limit: 230 seconds (app settings reference) vs 240 (Linux FAQ). The same FAQ says WEBSITES_PORT is required for custom containers and that ports 80 and 8080 are detected automatically.
App Service's Node.js page says build automation runs both npm install --production and plain npm install.
Functions' "runtime unreachable" page says to keep allowSharedKeyAccess true, which applies only to connection-string host storage.
Container Apps: one page says the portal adds default probes, another says the platform does.
Functions' plan table marks Linux Consumption "Retired" while the retirement notice gives September 30, 2028.

Azure Container Instances is covered for deployment errors only; virtual machine scale set orchestration, VM images and Azure Compute Gallery aren't covered.
Durable Functions, Functions on Container Apps and App Service Environments aren't covered.
Telemetry (APPLICATIONINSIGHTS_CONNECTION_STRING, Container Apps log destinations) is left to the observability family; VNet, NAT gateway and private DNS design to networking.