Static private IP for Azure Container Instance

Question

Static private IP for Azure Container Instance

Alexander Lapin 65

Hi! I have two ACIs in private network. Both containers have private ip address from subnet. But it is dynamic ip addreses. How do I can provide network between two containers if when I restart containers it changes private IP addresses. Maybe there is a DHCP reservation or something else. We also use nat rules for the load balancer, and in order for traffic from an external IP to reach the container, I indicate the internal IP address of the container, and if it changes, then this is of course not a reliable service. Thanks for any help.

0 comments

Answer accepted by question author

Nimmala Anveshreddy 3,560 Moderator

Hello Alexander Lapin, Welcome to microsoft Q&A, Thankyou for posting your query here. you can set up an internal Azure Load Balancer with a static private IP address to distribute traffic to your Azure Container Instances. This will allow you to ensure consistent access to the containers even if their private IP addresses change. Here are the general steps to set up an internal Azure Load Balancer with a static private IP address: 1.Create an Azure Load Balancer with a static private IP address. When you create the load balancer, be sure to specify the static private IP address that you want to use. 2.Create a backend pool for the load balancer and add your Azure Container Instances to the pool. When you add the container instances to the pool, be sure to specify the private IP addresses of the containers. 3.Create a health probe for the load balancer to monitor the health of the backend pool. 4.Create a load balancing rule for the load balancer to distribute traffic to the backend pool. When you create the rule, be sure to specify the static private IP address of the load balancer as the frontend IP address. Once you have set up the internal Azure Load Balancer with a static private IP address, you can use the IP address of the load balancer to access your Azure Container Instances. The load balancer will distribute traffic to the containers based on the load balancing rule that you created, and it will automatically update the routing as the private IP addresses of the containers change. Hope this answer helps you, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-26T05:50:15.98+00:00

Hello Alexander Lapin, If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!
Alexander Lapin 65 Reputation points

2024-02-26T06:46:13.31+00:00

Thanks for your reply. Apparently I didn't describe the problem very clearly. I have an instance of a container (ACI), I include it in a virtual network, which automatically assigns it an internal dynamic IP address; when the container is rebooted or turned off and on, this address may change to another. How can I make sure it doesn't change?
Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-26T10:05:09.02+00:00
Hello Alexander Lapin, Thankyou for replying back. Create a subnet with a delegated prefix of /29 or larger. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Deploy your container group to the subnet you created in step 1. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Assign a static private IP address to your container group. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Here's an example command using the Azure CLI:

az container update \ --resource-group <resource-group-name> \ --name <container-name> \ --image <container-image> \ --vnet <vnet-name> \ --subnet <subnet-name> \ --subnet-ip-address <reserved-ip-address> \ --restart-policy Always
Alexander Lapin 65 Reputation points

2024-02-26T10:40:36.48+00:00

az container --update command doesn't exist...
Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-27T07:02:16.3933333+00:00

Hello Alexander Lapin, We noticed that you rated an answer as not helpful. I have provided an answer with the relevant details to make this a positive experience for you. i. Azure Container Instances do not natively support assigning static IP addresses directly to individual containers. ii.Instead, one can mitigate this limitation by reserving a block of IP addresses within the subnet where ACI instances operate. iii. This reservation ensures a stable pool of IP addresses, thereby minimizing significant variations in dynamic allocations. iv. By reserving IP addresses within the subnet, organizations can establish a consistent and predictable range for their ACI instances. v. This predictability proves invaluable for implementing robust access control measures, such as IP-based whitelisting and access restriction policies. vi. The establishment of a predictable IP range through reserved addresses contributes to a more resilient and controlled environment by ensuring reliable enforcement of security measures. We value your feedback. If my answer is helpful, would you be so kind to re-evaluate your feedback, accept my answer and upvote the same please.
Alexander Lapin 65 Reputation points

2024-03-15T07:37:41.09+00:00

Good day. This solution, unfortunately, is a crutch, and you can only hope that at the most inopportune moment the address does not change, you pay money, and they offer you a crutch...
Tal Yitzhak 0 Reputation points

2025-03-24T09:39:06.7633333+00:00

@Anonymous Your answer on creating an Azure Internal Load balancer is misleading.
As mentioned here: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-virtual-network-concepts#unsupported-networking-scenarios

"Azure Load Balancer - Placing an Azure Load Balancer in front of container instances in a networked container group isn't supported".

I tried to follow your answer but saw this only after spending 4-5 hours on this, and it didn't work.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 additional answer

Your answer

Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-26T05:50:15.98+00:00

Hello Alexander Lapin, If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!
Alexander Lapin 65 Reputation points

2024-02-26T06:46:13.31+00:00

Thanks for your reply. Apparently I didn't describe the problem very clearly. I have an instance of a container (ACI), I include it in a virtual network, which automatically assigns it an internal dynamic IP address; when the container is rebooted or turned off and on, this address may change to another. How can I make sure it doesn't change?
Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-26T10:05:09.02+00:00

Hello Alexander Lapin, Thankyou for replying back. Create a subnet with a delegated prefix of /29 or larger. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Deploy your container group to the subnet you created in step 1. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Assign a static private IP address to your container group. You can do this using the Azure portal, Azure CLI, or Azure PowerShell. Here's an example command using the Azure CLI:

az container update \ --resource-group <resource-group-name> \ --name <container-name> \ --image <container-image> \ --vnet <vnet-name> \ --subnet <subnet-name> \ --subnet-ip-address <reserved-ip-address> \ --restart-policy Always
Alexander Lapin 65 Reputation points

2024-02-26T10:40:36.48+00:00

az container --update command doesn't exist...
Nimmala Anveshreddy 3,560 Reputation points Moderator

2024-02-27T07:02:16.3933333+00:00

Hello Alexander Lapin, We noticed that you rated an answer as not helpful. I have provided an answer with the relevant details to make this a positive experience for you. i. Azure Container Instances do not natively support assigning static IP addresses directly to individual containers. ii.Instead, one can mitigate this limitation by reserving a block of IP addresses within the subnet where ACI instances operate. iii. This reservation ensures a stable pool of IP addresses, thereby minimizing significant variations in dynamic allocations. iv. By reserving IP addresses within the subnet, organizations can establish a consistent and predictable range for their ACI instances. v. This predictability proves invaluable for implementing robust access control measures, such as IP-based whitelisting and access restriction policies. vi. The establishment of a predictable IP range through reserved addresses contributes to a more resilient and controlled environment by ensuring reliable enforcement of security measures. We value your feedback. If my answer is helpful, would you be so kind to re-evaluate your feedback, accept my answer and upvote the same please.
Alexander Lapin 65 Reputation points

2024-03-15T07:37:41.09+00:00

Good day. This solution, unfortunately, is a crutch, and you can only hope that at the most inopportune moment the address does not change, you pay money, and they offer you a crutch...
Tal Yitzhak 0 Reputation points

2025-03-24T09:39:06.7633333+00:00

@Anonymous Your answer on creating an Azure Internal Load balancer is misleading.
As mentioned here: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-virtual-network-concepts#unsupported-networking-scenarios

"Azure Load Balancer - Placing an Azure Load Balancer in front of container instances in a networked container group isn't supported".

I tried to follow your answer but saw this only after spending 4-5 hours on this, and it didn't work.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Hi Alexander,

What I would suggest is to have the container, upon startup, check its private IP and update the required resources (DNS, NAT rule, etc.) if needed before starting to listen for incoming connections. In this way things will not break when the private IP changes. You can enable System Managed Identity and assign necessary permissions so that the container can make changes.

Reason I say the above is because there currently isn't any way to set static IP for container instances.

If you need help on specifics of above please let me know more details about your configuration and I can help you work through writing/implementing the code. I'm asking for more details because I'm not 100% clear which resources need to be updated every time private IP changes in your design.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP