Azure container app can not pull image from azure container registry- ContainerAppOperationError

Question

Azure container app can not pull image from azure container registry- ContainerAppOperationError

Turic, Mario 0

Hello dear IT support,

we have an azure container app inside of our azure container environment, that can not pull an image from our azure container registry also in our same resource group and same private virtual network.

We checked that the image exists in the Azure container registry.

Currently we are getting the following issue when we try to create a new Azure Container App using that image from our Azure container registry:
"Failed to provision revision for container app 'test-andersen-dev-006'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.test-andersen-dev-006.image' is invalid with details: 'Invalid value: "acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/streamlit-app:latest": Get "https://acrandersendev001-dsb0e3gmh9g4atfa.germanywestcentral.data.azurecr.io?c=REDACTED&d=REDACTED… dial tcp: lookup [REGISTRY_LOGIN_DOMAIN] on 100.100.249.50:53: no such host';.. (Code: ContainerAppOperationError)"

We already checked the private DNS zone integrations and we even can make a "nslookup" for 1 of the 2 private IPs of the Azure Container registry, but the 2nd one is currently not able to be resolved.

The "nslookup" of the 1st private Endpoint called "[REGISTRY_LOGIN_DOMAIN]" of the Azure container registry was successfull.

The 2nd "nslookup" of the 2nd private endpoint called "acrandersendev001-dsb0e3gmh9g4atfa.germanywestcentral.data.azurecr.io" of the Azure container registry was NOT successfull.

Can you please let us know what might be the issue/root cause here and what we should check ?

Thank you and kind regards,

Mario Turic

Pravallika KV 18,855 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-23T15:05:52.2766667+00:00
Hi @Turic, Mario,

Thanks for reaching out to Microsoft Q&A.

Based on the error and DNS behavior, this is certainly a Private DNS / Private Endpoint configuration issue specific to the ACR data endpoint, not the image itself.

Your Container App cannot resolve the ACR data endpoint:

[REGISTRY_DATA_DOMAIN]

due to missing or misconfigured the Private DNS zone:

privatelink.germanywestcentral.data.azurecr.io

The login endpoint (*.azurecr.io) works, but the data endpoint does not, and Container Apps need both to pull images.

Check that:

The private DNS zone for the regional data endpoint exists

It is linked to your VNet

It contains the correct A record for your ACR private endpoint
Pravallika KV 18,855 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-24T11:49:25.9533333+00:00

Hi @Turic, Mario, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-25T13:50:36.83+00:00

Hello @Pravallika KV I had and we resolved the last issue but we are facing a new issue now:

Failed to provision revision for container app 'test-andersen-dev-002'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.test-andersen-dev-002.image' is invalid with details: 'Invalid value: "acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/streamlit-app:latest": Get "https://acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/v2/": EOF';.. (Code: ContainerAppOperationError)

Can you please let us know what you think where the root cause is ?

For me it looks like the docker image that is referenced is not correct or not existing ?
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-25T13:52:56.02+00:00

@Pravallika KV Also when I try to create an Azure Container App using the specific Azure Container App Environment, we are currently facing this issue - the deployment fails with this error message:

Failed to provision revision for container app 'test-andersen-002'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.test-andersen-002.image' is invalid with details: 'Invalid value: "acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/streamlit-app:latest": GET https:?scope=repository%3Astreamlit-app%3Apull&service=acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io: DENIED: client with IP '[REDACTED]' is not allowed access. Refer https://aka.ms/acr/firewall to grant access. CorrelationId: [CORRELATION_ID];.. (Code: ContainerAppOperationError).

It does not make sense to me as that IP address "[REDACTED]" is an Microsoft Azure IP address and should be able to reacht the Azure Container Registry in the Azure infrastructure although it is inside a private network - or please correct me if I am missing something here ?
Siddhesh Desai 8,210 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-25T19:04:25.9966667+00:00

Hi @Turic, Mario

Can you provide me the details, I have asked in Private chat? [EMAIL REMOVED]
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-26T08:31:59.0333333+00:00

Hello @Siddhesh Desai I have done so and thank you for your support.

1 Antwort

Ihre Antwort

Pravallika KV 18,855 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-23T15:05:52.2766667+00:00

Hi @Turic, Mario,

Thanks for reaching out to Microsoft Q&A.

Based on the error and DNS behavior, this is certainly a Private DNS / Private Endpoint configuration issue specific to the ACR data endpoint, not the image itself.

Your Container App cannot resolve the ACR data endpoint:

[REGISTRY_DATA_DOMAIN]

due to missing or misconfigured the Private DNS zone:

privatelink.germanywestcentral.data.azurecr.io

The login endpoint (*.azurecr.io) works, but the data endpoint does not, and Container Apps need both to pull images.

Check that:

The private DNS zone for the regional data endpoint exists

It is linked to your VNet

It contains the correct A record for your ACR private endpoint
Pravallika KV 18,855 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-24T11:49:25.9533333+00:00

Hi @Turic, Mario, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-25T13:50:36.83+00:00

Hello @Pravallika KV I had and we resolved the last issue but we are facing a new issue now:

Failed to provision revision for container app 'test-andersen-dev-002'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.test-andersen-dev-002.image' is invalid with details: 'Invalid value: "acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/streamlit-app:latest": Get "https://acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/v2/": EOF';.. (Code: ContainerAppOperationError)

Can you please let us know what you think where the root cause is ?

For me it looks like the docker image that is referenced is not correct or not existing ?
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-25T13:52:56.02+00:00

@Pravallika KV Also when I try to create an Azure Container App using the specific Azure Container App Environment, we are currently facing this issue - the deployment fails with this error message:

Failed to provision revision for container app 'test-andersen-002'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.test-andersen-002.image' is invalid with details: 'Invalid value: "acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io/streamlit-app:latest": GET https:?scope=repository%3Astreamlit-app%3Apull&service=acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io: DENIED: client with IP '[REDACTED]' is not allowed access. Refer https://aka.ms/acr/firewall to grant access. CorrelationId: [CORRELATION_ID];.. (Code: ContainerAppOperationError).

It does not make sense to me as that IP address "[REDACTED]" is an Microsoft Azure IP address and should be able to reacht the Azure Container Registry in the Azure infrastructure although it is inside a private network - or please correct me if I am missing something here ?
Siddhesh Desai 8,210 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-02-25T19:04:25.9966667+00:00

Hi @Turic, Mario

Can you provide me the details, I have asked in Private chat? [EMAIL REMOVED]
Turic, Mario 0 Zuverlässigkeitspunkte

2026-02-26T08:31:59.0333333+00:00

Hello @Siddhesh Desai I have done so and thank you for your support.

Answer 1

Hello @Turic, Mario

Please verify the following items:

1. ACR Network Configuration

In the registry under Networking, confirm whether:

Public network access is Disabled, or

Firewall rules are Enabled

If firewall rules are enabled, ensure the required access path is allowed.

2. Private Endpoint Usage

If the registry is intended to be accessed privately:

Ensure the ACR private endpoint is correctly configured

Verify that the Container Apps environment VNet can resolve the registry login server to the private IP

You can test this with:

nslookup acrandersendev001-dsb0e3gmh9g4atfa.azurecr.io

It should resolve to the private endpoint IP, not a public IP.

3. Private DNS Zone

Confirm the following private DNS zones exist and are linked to the VNet used by the Container Apps environment:

privatelink.azurecr.io

privatelink.germanywestcentral.data.azurecr.io

Both endpoints must resolve privately for image pulls to work.

4. Container Apps Managed Identity Permissions

Also confirm that the Container App (or environment identity) has the AcrPull role assigned on the registry.

Praveen Kumar Gudipudi 2,295 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2026-03-16T08:19:20.5533333+00:00

Hello @Turic, Mario

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.