Container Apps errors

Find the failing stage first. No revision created → image or registry. Revision created but not ready → the container, its probes or its port. Revision healthy but requests fail → ingress or networking. Then read the matching log: system logs (ContainerAppSystemLogs_CL, or ContainerAppSystemLogs with diagnostic settings: reference/monitor/diagnostic-settings-and-data-collection.md) for pulls, probes, identity and secrets; console logs (ContainerAppConsoleLogs_CL) for your app's stdout and stack traces.

az containerapp show -n <app> -g <rg> --query "{provisioning:properties.provisioningState, latest:properties.latestRevisionName}" -o json
az containerapp revision list -n <app> -g <rg> --query "[].{name:name, health:properties.healthState, state:properties.provisioningState}" -o table
az containerapp logs show -n <app> -g <rg> --type system --tail 50

Image and registry

Message	Cause → fix	Check
`Error provisioning revision <name>. ErrorCode: [ErrImagePull]`; `ImagePullBackOff`; `UNAUTHORIZED`; no revision created	Wrong image name or tag; missing or expired registry credentials; the pulling identity lacks AcrPull (or Container Registry Repository Reader on an ABAC-mode registry); registry firewall or DNS; Docker Hub rate limits	`az acr repository show-tags -n <acr> --repository <repo>`; `az containerapp show -n <app> -g <rg> --query properties.configuration.registries`
Pull with `identity: 'system'` fails on the first deployment	The system-assigned identity doesn't exist until the app does, so it can't hold AcrPull before the first pull. Use a user-assigned identity with AcrPull granted beforehand (Microsoft recommends user-assigned), or create the app with a public image first	Role assignments on the registry
Updating to the same image tag doesn't pick up a new image or re-check it	Image pull validation runs only when the image reference changes. Deploy immutable tags (a commit SHA or digest)	The revision's image

The revision never becomes ready

Message	Cause → fix	Check
`Error provisioning revision <name>. ErrorCode: [ContainerCrashing]`; `Error: ContainerCrashed`; `CrashLoopBackOff`	The process exits: unhandled error, missing file or setting, wrong command or entrypoint, or out of memory	Console logs for the last lines before exit; system logs for OOM
`Error provisioning revision <name>. ErrorCode: [Time-out]`; `Deployment Progress Deadline Exceeded. 0/1 replicas ready.`; revision stuck in Provisioning	Slow startup against the probes, an init container that doesn't finish, or a port mismatch	Probe settings; `properties.template.initContainers`
Revision `Degraded` with 0 ready replicas	Probes failing. With HTTP ingress and no custom probes, TCP startup, liveness and readiness probes are added on the ingress target port (Microsoft's pages disagree on whether the portal or the platform adds them; assume they exist). An app listening elsewhere never passes	`az containerapp show -n <app> -g <rg> --query "properties.template.containers[0].probes"`
`Error: ingress routes not ready`	Ingress didn't come up for the revision, usually because no replica got ready	The probe and port rows above
Target port mismatch (app on 8080, ingress `targetPort` 80, or the reverse)	Set `targetPort` to the port the app listens on and `EXPOSE` it. Also bind to all interfaces (`0.0.0.0`): a server bound to `localhost` can't be reached from outside the container (the hub's reading; not on Microsoft's page)	`az containerapp ingress show -n <app> -g <rg> --query targetPort`
`Error mounting volume <name>.`	The storage mount's account, share, key or network is wrong	`az containerapp env storage list -n <env> -g <rg>`
Secret or environment variable empty at runtime	A `secretref:` to a missing secret, or a Key Vault secret reference the app's identity can't read	`az containerapp secret list -n <app> -g <rg>` (names only)
`Error fetching scaler metrics`	The scale rule can't reach its source (queue, Event Hubs, database) or authenticate to it	The scale rule's auth (`secretRef` or identity) and network path

Serving and identity

Symptom	Cause → fix
Endpoint returns 403 or 502	Ingress is internal, or IP restrictions, or the revision has no ready replica; with multiple-revision mode, traffic may point at an old revision
Managed identity returns 401 or 403 to the app	The identity isn't assigned to the app, the code didn't pass the user-assigned client ID, or the target resource lacks the role (`reference/managed-identity/errors.md`)
Environment creation fails with a capacity error	The region lacks capacity at that moment. A quota increase doesn't help: retry later, in another region, or without zone redundancy. A quota error is different: request more

App configuration: reference/container-apps/apps-ingress-and-scale.md. Registry-side errors: reference/container-registry/errors.md.