--- cuppy_hub: azure cuppy_path: reference/container-apps/errors.md cuppy_section: docs cuppy_doc: 0E4Y-5PR8 cuppy_doc_uuid: 91f9eecd-0ebc-4a2d-96a6-51cf3e4536f2 cuppy_permalink: https://cuppy.io/azure/d/0E4Y-5PR8 cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/container-apps/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 4ac3ca5e4b77b744ff11ba236d3430ed32d3781a0785b2e95cfc4d3e1e82233b # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Container Apps errors **Find the failing stage first.** No revision created → image or registry. Revision created but not ready → the container, its probes or its port. Revision healthy but requests fail → ingress or networking. Then read the matching log: **system logs** (`ContainerAppSystemLogs_CL`, or `ContainerAppSystemLogs` with diagnostic settings: `reference/monitor/diagnostic-settings-and-data-collection.md`) for pulls, probes, identity and secrets; **console logs** (`ContainerAppConsoleLogs_CL`) for your app's stdout and stack traces. ```bash az containerapp show -n -g --query "{provisioning:properties.provisioningState, latest:properties.latestRevisionName}" -o json az containerapp revision list -n -g --query "[].{name:name, health:properties.healthState, state:properties.provisioningState}" -o table az containerapp logs show -n -g --type system --tail 50 ``` ## Image and registry | Message | Cause → fix | Check | |---|---|---| | `Error provisioning revision . ErrorCode: [ErrImagePull]`; `ImagePullBackOff`; `UNAUTHORIZED`; no revision created | Wrong image name or tag; missing or expired registry credentials; the pulling identity lacks **AcrPull** (or **Container Registry Repository Reader** on an ABAC-mode registry); registry firewall or DNS; Docker Hub rate limits | `az acr repository show-tags -n --repository `; `az containerapp show -n -g --query properties.configuration.registries` | | Pull with `identity: 'system'` fails on the first deployment | The system-assigned identity doesn't exist until the app does, so it can't hold AcrPull before the first pull. Use a **user-assigned identity** with AcrPull granted beforehand (Microsoft recommends user-assigned), or create the app with a public image first | Role assignments on the registry | | Updating to the same image tag doesn't pick up a new image or re-check it | Image pull validation runs only when the image reference changes. Deploy immutable tags (a commit SHA or digest) | The revision's image | ## The revision never becomes ready | Message | Cause → fix | Check | |---|---|---| | `Error provisioning revision . ErrorCode: [ContainerCrashing]`; `Error: ContainerCrashed`; `CrashLoopBackOff` | The process exits: unhandled error, missing file or setting, wrong command or entrypoint, or out of memory | Console logs for the last lines before exit; system logs for OOM | | `Error provisioning revision . ErrorCode: [Time-out]`; `Deployment Progress Deadline Exceeded. 0/1 replicas ready.`; revision stuck in Provisioning | Slow startup against the probes, an init container that doesn't finish, or a port mismatch | Probe settings; `properties.template.initContainers` | | Revision `Degraded` with 0 ready replicas | **Probes failing.** With HTTP ingress and no custom probes, TCP startup, liveness and readiness probes are added on the **ingress target port** (Microsoft's pages disagree on whether the portal or the platform adds them; assume they exist). An app listening elsewhere never passes | `az containerapp show -n -g --query "properties.template.containers[0].probes"` | | `Error: ingress routes not ready` | Ingress didn't come up for the revision, usually because no replica got ready | The probe and port rows above | | Target port mismatch (app on 8080, ingress `targetPort` 80, or the reverse) | Set `targetPort` to the port the app listens on and `EXPOSE` it. Also bind to all interfaces (`0.0.0.0`): a server bound to `localhost` can't be reached from outside the container (the hub's reading; not on Microsoft's page) | `az containerapp ingress show -n -g --query targetPort` | | `Error mounting volume .` | The storage mount's account, share, key or network is wrong | `az containerapp env storage list -n -g ` | | Secret or environment variable empty at runtime | A `secretref:` to a missing secret, or a Key Vault secret reference the app's identity can't read | `az containerapp secret list -n -g ` (names only) | | `Error fetching scaler metrics` | The scale rule can't reach its source (queue, Event Hubs, database) or authenticate to it | The scale rule's auth (`secretRef` or identity) and network path | ## Serving and identity | Symptom | Cause → fix | |---|---| | Endpoint returns 403 or 502 | Ingress is internal, or IP restrictions, or the revision has no ready replica; with multiple-revision mode, traffic may point at an old revision | | Managed identity returns 401 or 403 to the app | The identity isn't assigned to the app, the code didn't pass the user-assigned client ID, or the target resource lacks the role (`reference/managed-identity/errors.md`) | | Environment creation fails with a **capacity** error | The region lacks capacity at that moment. A quota increase doesn't help: retry later, in another region, or without zone redundancy. A **quota** error is different: request more | App configuration: `reference/container-apps/apps-ingress-and-scale.md`. Registry-side errors: `reference/container-registry/errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.