App Service for Web App for Containers, Container Registry and Private Endpoints

specialsnowflake 36 Reputation points

I have created in our Azure subscription an App Service (Web App for Containers, single container, App Service plan is P1v2) and a Container Registry (Premium). I have connected both the App Service and the ACR to a VNet using private endpoints. I have also configured VNet Integration for the App Service to the VNet.

When I set the Public Access of the ACR to disabled, I expect to force the App Service to pull its image from the ACR using only the networking of the VNet. Instead I get an error when trying to pull the image:

ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get denied: client with IP 'XX.XXX.XX.XXX' is not allowed access. Refer to grant access."}

If I then set the Public Access of the ACR to "Selected networks" and allow the IP address listed in the error above, it works.

My questions:

  1. Is the private endpoint scenario above not supported (App Service for Containers accessing ACR)? If not, is it being worked on for support and when will it be supported?
  2. If the above is not supported, how do I use Azure CLI to get the above IP address besides waiting for an error and pulling it from the text of the error? It's not the IP address associated with any of the virtual NICs nor the IP Address that nslookup resolves to when looking up the public host listed in the URL for the App Service.

Thanks for your help.

Azure Container Registry
Azure Container Registry
An Azure service that provides a registry of Docker and Open Container Initiative images.
274 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
4,904 questions
{count} votes

Accepted answer
  1. prmanhas-MSFT 17,736 Reputation points Microsoft Employee

    @specialsnowflake I had discussion internally and below is the response I got:

    As noted earlier – the private link scenario isn’t supported yet on App Service. And beyond we’re working on it and hope to land it sometime between now and end of June, there is not a more specific ETA.

    What the customer might be seeing is one of the pool of outbound IP addresses used the App Service scale unit where the app is running. You can adding all of the outbound IP addresses associated with the app to their address allow list in ACR.

    When looking at your outbound addresses you will see that there are two sets. If you look in your app Properties you can see them or use the command line items referred above.

    When you set up a firewall though, use the Additional Outbound IP Addresses or possibleOutboundAddresses, however it shows up. It is the superset of what is possible for your app to use. That way if you scale it up or down across SKUs, it will still work.

    Hope it helps!!!

    Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics

    2 people found this answer helpful.

4 additional answers

Sort by: Most helpful
  1. Lucas Camargo Reis 86 Reputation points

    Hi @specialsnowflake

    Can you confirm if you use a Azure DNS Zones resolving IPs for yours Private Links inside a VNET?

    To access a resource in Azure using a Private Link you need to integrate with a Azure DNS Zones or configure your DNS Servers like this documentation:

    1 person found this answer helpful.

  2. Kim Zachariassen 6 Reputation points

    See this blog for solution:

    The WEBSITE_PULL_IMAGE_OVER_VNET setting is what you need.

    1 person found this answer helpful.

  3. prmanhas-MSFT 17,736 Reputation points Microsoft Employee

    @specialsnowflake Apologies for the delay in response and all the inconvenience caused because of the issue.

    I had discussion internally and got to know It is not supported yet. This indeed is on roadmap and our engineering team is working on same but currently I dont have an ETA to share.

    Hope it helps!!!

    Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics

  4. Abhilash Konnur 1 Reputation point Microsoft Employee

    @specialsnowflake not sure if you already found the answer. The outbound IP's of App Service can be found in Properties blade.

    0 comments No comments