Unable to connect to Private Registry from an App Service

Question

Ciao!

We are in a process of migrating an on-prem app to Azure. We have created an App Service running in Linux. The App Service Plan is running on B1 sku (while in Dev). We have the below variables configured. In the deployment center, we have it configured to point to the on-prem harbor container, have provided correct credentials, image name and tag. We have also attached a company's root certificate under the Public key certificate tab as the harbor container on-prem uses the same too.

We can ping and resolve the harbor container from the app service.

We are using private endpoint and vNet is integrated.

Here are the errors:

2024-11-25T17:26:34.998Z INFO - Attempting to pull image harbor.xxxx.com/company-noncritical-apps/yyyy-app:1.7.10-f8 from VNET.

2024-11-25T17:26:39.571Z ERROR - Image pull for harbor.xxxx.com/company-noncritical-apps/yyyy-app:1.7.10-f8 failed. UnexpectedFaliure

2024-11-25T17:26:39.581Z ERROR - Pulling docker image harbor.xxxx.com/company-noncritical-apps/yyyy-app:1.7.10-f8 over VNET failed.

2024-11-25T17:26:39.589Z WARN - Image pull failed. Defaulting to local copy if present.

2024-11-25T17:26:39.599Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)

2024-11-25T17:26:39.611Z INFO - Stopping site xxxxxx because it failed during startup.

Answer 1

Hi @Dia , please make sure these two settings:

1. Virtual Network integration of the App Service - tick the Container image pull:
2. Environment variable WEBSITE_PULL_IMAGE_OVER_VNET is set to TRUE:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Answer 2

Hi Dia,
Thankyou for your Response.

Since you have already validated DNS and VNet integration, the issue could indeed be related to certificates.

Ensure the Harbor registry root certificate is uploaded under TLS/SSL Settings > Public Key Certificates in the App Service.

The App Service only trusts certificates from this store during TLS handshake.

Use Kudu Console to test the Harbor registry endpoint.

curl -v https://harbor.xxxx.com --cacert /path/to/certificate

Replace /path/to/certificate with the cert path in your container or App Service.

Confirm the Environment Variable WEBSITE_PULL_IMAGE_OVER_VNET is set to TRUE to enforce the private endpoint usage.

Use PowerShell/Kudu Console to validate connectivity to Harbor.

Test-NetConnection harbor.xxxx.com -Port 443
Any certificate errors will surface during this check.

Confirm no outbound NSG rules or routing misconfigurations are blocking traffic to the registry.
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2CRBAC
https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint
You can mark it 'Accept Answer' and 'Upvote' if this helped you