ENOTFOUND from one of my containerapp to ***.postgres.azure.com despite settingup peering, private dnszone and linking

Question

ENOTFOUND from one of my containerapp to ***.postgres.azure.com despite settingup peering, private dnszone and linking

RATNAKAR KATIPALLY 0

Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-19T00:47:11.0533333+00:00
@RATNAKAR KATIPALLY

It seems like you're encountering an "NOTFOUND" error when trying to connect your Container App to the PostgreSQL database despite having set up peering and a private DNS zone. This is likely related to DNS resolution issues in your networking setup. Here are a few steps you can take to troubleshoot this:

Verify DNS Configuration:

Ensure that the private DNS zone is properly linked to the virtual network where your Container App resides. You can check this in the Azure portal under the Private DNS zones section.

Check Private Endpoint:

Confirm that you have created a private endpoint for your PostgreSQL server. The DNS query needs to resolve to the private IP address of that endpoint.

DNS Forwarding:

If you're using a custom DNS server, make sure it’s configured to forward requests for Azure private DNS zones to the Azure-provided DNS (168.63.129.16).

Network Security Groups (NSGs):

Make sure that any NSGs or firewalls are not blocking access to the private DNS zone or the IP address of the PostgreSQL database.

Testing DNS Resolution:

Within your Container App, use tools like nslookup or dig to check if you can resolve the FQDN of your PostgreSQL server (e.g., privatelink.postgres.database.azure.com). This will help you verify if the DNS setup is functioning correctly.
Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-21T10:37:34.4166667+00:00

@RATNAKAR KATIPALLY

Just checking in to see if the above information was helpful. Let me know if you have any questions or need further clarification.

2 answers

Your answer

Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-19T00:47:11.0533333+00:00

@RATNAKAR KATIPALLY

It seems like you're encountering an "NOTFOUND" error when trying to connect your Container App to the PostgreSQL database despite having set up peering and a private DNS zone. This is likely related to DNS resolution issues in your networking setup. Here are a few steps you can take to troubleshoot this:

Verify DNS Configuration:

Ensure that the private DNS zone is properly linked to the virtual network where your Container App resides. You can check this in the Azure portal under the Private DNS zones section.

Check Private Endpoint:

Confirm that you have created a private endpoint for your PostgreSQL server. The DNS query needs to resolve to the private IP address of that endpoint.

DNS Forwarding:

If you're using a custom DNS server, make sure it’s configured to forward requests for Azure private DNS zones to the Azure-provided DNS (168.63.129.16).

Network Security Groups (NSGs):

Make sure that any NSGs or firewalls are not blocking access to the private DNS zone or the IP address of the PostgreSQL database.

Testing DNS Resolution:

Within your Container App, use tools like nslookup or dig to check if you can resolve the FQDN of your PostgreSQL server (e.g., privatelink.postgres.database.azure.com). This will help you verify if the DNS setup is functioning correctly.
Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-21T10:37:34.4166667+00:00

@RATNAKAR KATIPALLY

Just checking in to see if the above information was helpful. Let me know if you have any questions or need further clarification.

Answer 1

RATNAKAR KATIPALLY 0

Though the above changes did not help, I have moved all the resources into one v-net under one resource group, and that resolved it.

Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-21T11:26:57.0833333+00:00

@RATNAKAR KATIPALLY

Could you please check the private message and Respond

Here is the reference link on how to access & data retention policy of private messages in Microsoft Q&A.

Answer 2

Sai Prabhu Naveen Parimi 2,020 Microsoft External Staff Moderator

@RATNAKAR KATIPALLY

Thanks for the update and confirmation.

To summarize for anyone facing a similar issue:

You were encountering an ENOTFOUND error from the Azure Container App when trying to connect to ***.postgres.azure.com, even after setting up VNet peering, a private endpoint for PostgreSQL, and linking the appropriate private DNS zone.

This issue was ultimately resolved by you moving all related resources (Container App, PostgreSQL server, DNS zone, etc.) into a single Virtual Network under one Resource Group.

Regarding your observation that the container image wasn’t updating:

This behavior is expected if the same tag (like latest) is reused. Azure Container Apps pulls images based on the image digest, not just the tag. If the digest doesn't change, the platform assumes it's the same image and doesn't redeploy. Using unique image tags or triggering a new revision helps Azure detect and apply changes as expected.

Please do not forget to click "Accept the answer” and Yes wherever the information provided helps you, this can be beneficial to other community members. User's image

RATNAKAR KATIPALLY 0 Reputation points

2025-05-21T15:34:03.7966667+00:00

But, I wonder why the above suggestions did not work. Prior to your answer, I have tried the same above steps as per the azure documentation and did not work as expected.

On top of that, the container images were not getting updated with the latest images whenever I deploy with changes. so it was quite difficult to figure out the root causes.

So, as of now I resolved the issue by moving all the services under one resource group and one v-net.
Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-22T07:00:27.3033333+00:00
@RATNAKAR KATIPALLY

Thanks for bringing this up. The issue with your container app not picking up the latest image is usually due to Azure not detecting any real change when the same image tag (like latest) is used.

Even though Azure Container Apps tries to pull images on every revision, it checks the image's digest behind the scenes. If the digest hasn’t changed (even if you pushed a new build with the same tag), the app might keep using the old version.

To fix this going forward, I recommend:

Tagging each image uniquely (like v1.0.1, build20250521, etc.)

Or triggering a new revision by changing a config value or restarting the revision manually.

You can also check these documents for a quick overview:

Update and deploy changes in Azure Container Apps Explains how Azure Container Apps handle updates, revisions, and what triggers a new deployment.

https://learn.microsoft.com/en-us/azure/container-apps/revisions

Manage revisions in Azure Container Apps Walks you through manual revision management and how to restart or activate/deactivate revisions. https://learn.microsoft.com/en-us/azure/container-apps/revisions-manage

Pull container images using managed identity Useful if your container registry is private — explains how Azure ensures secure image pulls, including digest-based behavior.

https://learn.microsoft.com/en-us/azure/container-apps/managed-identity-image-pull

Best practices for tagging container images Recommends how to version/tag your images to avoid issues with reused tags.

https://learn.microsoft.com/en-us/azure/container-registry/container-registry-image-tag-version
Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-23T09:44:28.06+00:00

@RATNAKAR KATIPALLY

Just wanted to check if you had a chance to review the suggestion I shared about tagging container images uniquely or triggering a new revision to ensure Azure picks up the latest version.
Sai Prabhu Naveen Parimi 2,020 Reputation points Microsoft External Staff Moderator

2025-05-26T06:17:08.8366667+00:00

@RATNAKAR KATIPALLY

Just checking if you had a chance to review my suggestion on tagging container images or triggering a new revision.
RATNAKAR KATIPALLY 0 Reputation points

2025-05-26T07:47:04.34+00:00

Yeah, tagging each image uniquely helped.

Share via

ENOTFOUND from one of my containerapp to ***.postgres.azure.com despite settingup peering, private dnszone and linking

2 answers

Your answer