Document Details
Configure Custom Container
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Detected Bias Types
windows_first
powershell_heavy
windows_tools
missing_linux_example
Summary
The documentation page exhibits several Windows-centric biases. Windows-specific details, examples, and tooling (such as PowerShell and Windows Server image recommendations) are often presented first or exclusively, while Linux equivalents are sometimes less detailed or omitted. PowerShell commands are frequently included alongside Bash, and Windows-specific concepts (like IIS, .NET Framework, and C:\home) receive more thorough coverage. Some advanced configuration and troubleshooting sections are richer for Windows than for Linux, and certain Linux instructions (e.g., SSH setup) are relegated to later sections.
Recommendations
- Ensure Linux examples and instructions are presented with equal prominence and detail as Windows, including parent image recommendations and troubleshooting steps.
- Where PowerShell commands are provided, always include equivalent Bash or shell commands for Linux users, and consider listing Bash first in Linux-focused sections.
- Expand Linux-specific guidance for advanced topics such as persistent storage, diagnostic logging, and environment variable management to match Windows coverage.
- Avoid Windows-first ordering in general sections; use neutral or parallel presentation for cross-platform features.
- Clarify differences in default behaviors (e.g., persistent storage enabled/disabled) in a comparative table or summary for quick reference.
- Add more Linux-specific troubleshooting tips and references, similar to the depth given for Windows containers.
Create Pull Request
Scan History
| Date | Scan | Status | Result |
|---|---|---|---|
| 2026-01-12 00:00 | #99 | completed |
Biased
|
| 2026-01-11 06:20 | #98 | completed |
 Clean
|
| 2026-01-11 00:00 | #95 | cancelled |
Clean
|
| 2026-01-10 00:00 | #92 | completed |
Biased
|
| 2026-01-09 00:00 | #87 | cancelled |
Biased
|
| 2026-01-08 00:00 | #84 | in_progress |
Clean
|
| 2026-01-06 22:28 | #78 | completed |
Clean
|
| 2025-12-29 18:00 | #48 | cancelled |
Clean
|
| 2025-12-22 00:00 | #24 | cancelled |
Biased
|
| 2025-12-15 00:00 | #7 | completed |
Clean
|
| 2025-12-14 05:05 | #6 | completed |
Clean
|
Flagged Code Snippets
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the `<identity-name>` of your user-assigned managed identity and use the output `<client-id>` to configure the user-assigned managed identity ID.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
The value is defined in megabytes (MB) and must be less and equal to the total physical memory of the host. For example, in an App Service plan with 8 GB of RAM, the cumulative total of `WEBSITE_MEMORY_LIMIT_MB` for all the apps can't exceed 8 GB. For more information on how much memory is available, see the Premium v3 service plan in [App Service pricing](https://azure.microsoft.com/pricing/details/app-service/windows/). ## Customize the number of compute cores By default, a Windows container runs with all available cores for your pricing tier. You might want to reduce the number of cores that your staging slot uses. To reduce the number of cores that a container uses, set the `WEBSITE_CPU_CORES_LIMIT` app setting to the preferred number of cores. You can set it by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In your `docker-compose.yml` file, map the `volumes` option to `${WEBAPP_STORAGE_HOME}`.
`WEBAPP_STORAGE_HOME` is an environment variable in App Service that maps to persistent storage for your app. For example:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the `<identity-name>` of your user-assigned managed identity and use the output `<client-id>` to configure the user-assigned managed identity ID.
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace *\<registry-name>* with the name of your registry. The output of the command, filtered by the `--query` and `--output` arguments, is the resource ID of the container registry. 1. Grant the managed identity permission to access the container registry:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
The web app now uses managed identity to pull from Azure Container Registry. ## Use an image from a network-protected registry To connect and pull from a registry inside a virtual network or on-premises, your app must integrate with a virtual network. You also need virtual network integration for Azure Container Registry with a private endpoint. After you configure your network and DNS resolution, enable the routing of the image pull through the virtual network. Configure the `vnetImagePullEnabled` site setting:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
The processors might be multicore or hyper-threading processors. To find out how many cores are available, see the Premium v3 service plan in [App Service pricing](https://azure.microsoft.com/pricing/details/app-service/windows/). ## Customize health ping behavior App Service considers a container to be successfully started when the container starts and responds to an HTTP ping. The health ping request contains the header `User-Agent= "App Service Hyper-V Container Availability Check"`. If the container starts but doesn't respond to pings after a certain amount of time, App Service logs an event in the Docker log. If your application is resource intensive, the container might not respond to the HTTP ping in time. To control what happens when HTTP pings fail, set the `CONTAINER_AVAILABILITY_CHECK_MODE` app setting. You can set it by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In your `docker-compose.yml` file, map the `volumes` option to `${WEBAPP_STORAGE_HOME}`.
`WEBAPP_STORAGE_HOME` is an environment variable in App Service that maps to persistent storage for your app. For example:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
The web app now uses managed identity to pull from Azure Container Registry. ## Use an image from a network-protected registry To connect and pull from a registry inside a virtual network or on-premises, your app must integrate with a virtual network. You also need virtual network integration for Azure Container Registry with a private endpoint. After you configure your network and DNS resolution, enable the routing of the image pull through the virtual network. Configure the `vnetImagePullEnabled` site setting:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
--- 1. Add the following instructions to the Dockerfile according to the base image distribution. These instructions copy the new files, install the OpenSSH server, set proper permissions and configure the custom entrypoint, and expose the ports required by the application and SSH server, respectively: ### [Debian](#tab/debian)
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace *\<registry-name>* with the name of your registry. The output of the command, filtered by the `--query` and `--output` arguments, is the resource ID of the container registry. 1. Grant the managed identity permission to access the container registry:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values: - *\<principal-id>* with the service principal ID from the `az webapp identity assign` command - *\<registry-resource-id>* with the ID of your container registry from the `az acr show` command For more information about these permissions, see [What is Azure role-based access control?](../role-based-access-control/overview.md). 1. Configure your app to use the managed identity to pull from Azure Container Registry.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
The value is defined in megabytes (MB) and must be less and equal to the total physical memory of the host. For example, in an App Service plan with 8 GB of RAM, the cumulative total of `WEBSITE_MEMORY_LIMIT_MB` for all the apps can't exceed 8 GB. For more information on how much memory is available, see the Premium v3 service plan in [App Service pricing](https://azure.microsoft.com/pricing/details/app-service/windows/). ## Customize the number of compute cores By default, a Windows container runs with all available cores for your pricing tier. You might want to reduce the number of cores that your staging slot uses. To reduce the number of cores that a container uses, set the `WEBSITE_CPU_CORES_LIMIT` app setting to the preferred number of cores. You can set it by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
The web app now uses managed identity to pull from Azure Container Registry. ## Use an image from a network-protected registry To connect and pull from a registry inside a virtual network or on-premises, your app must integrate with a virtual network. You also need virtual network integration for Azure Container Registry with a private endpoint. After you configure your network and DNS resolution, enable the routing of the image pull through the virtual network. Configure the `vnetImagePullEnabled` site setting:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace *\<app-name>* with the name you used in the previous step. The output of the command, filtered by the `--query` and `--output` arguments, is the service principal ID of the assigned identity. 1. Get the resource ID of your container registry:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
The web app now uses managed identity to pull from Azure Container Registry. ## Use an image from a network-protected registry To connect and pull from a registry inside a virtual network or on-premises, your app must integrate with a virtual network. You also need virtual network integration for Azure Container Registry with a private endpoint. After you configure your network and DNS resolution, enable the routing of the image pull through the virtual network. Configure the `vnetImagePullEnabled` site setting:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
--- > [!NOTE] > The root password must be exactly `Docker!` because App Service uses it to grant you access to the SSH session with the container. This configuration doesn't allow external connections to the container. The container's port `2222` is accessible only within the bridge network of a private virtual network. An attacker on the internet can't access it. 1. Rebuild and push the Docker image to the registry, and then test the **Web App SSH** feature in the Azure portal. For more troubleshooting information, see the Azure App Service blog: [Enable SSH on a Linux web app for containers](https://azureossd.github.io/2022/04/27/2022-Enabling-SSH-on-Linux-Web-App-for-Containers/index.html#troubleshooting). ## Access diagnostic logs [!INCLUDE [Access diagnostic logs](../../includes/app-service-web-logs-access-linux-no-h.md)] ## Configure multi-container apps > [!NOTE] > The Docker Compose feature will be retired on March 31, 2027. Sidecar containers succeed multi-container apps in App Service. For new services, see [Tutorial: Configure a sidecar container for custom container in Azure App Service](tutorial-custom-container-sidecar.md). For existing multi-container apps in App Service, see [Migrate your Docker Compose applications to the sidecar feature](https://azure.github.io/AppService/2025/04/01/Docker-compose-migration.html). - [Use persistent storage in Docker Compose](#use-persistent-storage-in-docker-compose) - [Preview limitations](#preview-limitations) - [Docker Compose options](#docker-compose-options) ### Use persistent storage in Docker Compose Multi-container apps like WordPress need persistent storage to function properly. To enable persistent storage, your Docker Compose configuration must point to a storage location *outside* your container. Storage locations inside your container don't persist changes beyond app restart. To enable persistent storage, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting. Use the [`az webapp config appsettings set`](/cli/azure/webapp/config/appsettings#az-webapp-config-appsettings-set) command in [Cloud Shell](https://shell.azure.com).
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the `<identity-name>` of your user-assigned managed identity and use the output `<client-id>` to configure the user-assigned managed identity ID.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace *\<registry-name>* with the name of your registry. The output of the command, filtered by the `--query` and `--output` arguments, is the resource ID of the container registry. 1. Grant the managed identity permission to access the container registry:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace *\<registry-name>* with the name of your registry. The output of the command, filtered by the `--query` and `--output` arguments, is the resource ID of the container registry. 1. Grant the managed identity permission to access the container registry:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values: - *\<principal-id>* with the service principal ID from the `az webapp identity assign` command - *\<registry-resource-id>* with the ID of your container registry from the `az acr show` command For more information about these permissions, see [What is Azure role-based access control?](../role-based-access-control/overview.md). 1. Configure your app to use the managed identity to pull from Azure Container Registry.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace *\<app-name>* with the name you used in the previous step. The output of the command, filtered by the `--query` and `--output` arguments, is the service principal ID of the assigned identity. 1. Get the resource ID of your container registry:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
The web app now uses managed identity to pull from Azure Container Registry. ## Use an image from a network-protected registry To connect and pull from a registry inside a virtual network or on-premises, your app must integrate with a virtual network. You also need virtual network integration for Azure Container Registry with a private endpoint. After you configure your network and DNS resolution, enable the routing of the image pull through the virtual network. Configure the `vnetImagePullEnabled` site setting:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
Replace the `<identity-name>` of your user-assigned managed identity and use the output `<client-id>` to configure the user-assigned managed identity ID.
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace *\<app-name>* with the name you used in the previous step. The output of the command, filtered by the `--query` and `--output` arguments, is the service principal ID of the assigned identity. 1. Get the resource ID of your container registry:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
In PowerShell, use the following command:
In PowerShell, use the following command:
See a [full example](https://github.com/azureossd/docker-container-ssh-examples/blob/main/alpine-node/init_container.sh). If your app uses images from a private registry or from Docker Hub, the credentials for accessing the repository are saved in environment variables: `DOCKER_REGISTRY_SERVER_URL`, `DOCKER_REGISTRY_SERVER_USERNAME`, and `DOCKER_REGISTRY_SERVER_PASSWORD`. Because of security risks, none of these reserved variable names are exposed to the application. ::: zone pivot="container-windows" For Internet Information Services (IIS) or .NET Framework (4.0 or later) containers, credentials are automatically injected into `System.ConfigurationManager` as .NET app settings and connection strings by App Service. For all other languages or frameworks, they're provided as environment variables for the process, with one of the following prefixes: - `APPSETTING_` - `SQLCONTR_` - `MYSQLCONTR_` - `SQLAZURECOSTR_` - `POSTGRESQLCONTR_` - `CUSTOMCONNSTR_` ::: zone-end ::: zone pivot="container-linux" You can use this method for both single-container or multi-container apps, where the environment variables are specified in the `docker-compose.yml` file. ::: zone-end ## Use persistent shared storage ::: zone pivot="container-windows" You can use the `C:\home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. By default, persistent storage is *enabled* on Windows custom containers. To disable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `false` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
In PowerShell, use the following command:
::: zone-end > [!NOTE] > You can also [configure your own persistent storage](configure-connect-to-azure-storage.md). ## Detect HTTPS session App Service terminates TLS at the front ends. That means that TLS requests never get to your app. You don't need to, and shouldn't, implement any support for TLS into your app. The front ends are located inside Azure datacenters. If you use TLS with your app, your traffic across the internet is always safely encrypted. ::: zone pivot="container-windows" ## Customize ASP.NET machine key injection During the container start, keys are automatically generated and injected into the container as the machine keys for ASP.NET cryptographic routines. You can [find these keys in your container](#connect-to-the-container) by looking for the following environment variables: `MACHINEKEY_Decryption`, `MACHINEKEY_DecryptionKey`, `MACHINEKEY_ValidationKey`, and `MACHINEKEY_Validation`. The new keys at each restart might reset ASP.NET forms authentication and view state, if your app depends on them. To prevent the automatic regeneration of keys, [set them manually as App Service app settings](#configure-environment-variables). ## Connect to the container To connect to your Windows container directly for diagnostic tasks, go to `https://<app-name>.scm.azurewebsites.net/` and select the SSH option. This option establishes a direct SSH session in which you can run commands inside your container. - It functions separately from the graphical browser above it, which only shows the files in your [shared storage](#use-persistent-shared-storage). - In a scaled-out app, the SSH session connects to one of the container instances. You can select a different instance from the **Instance** dropdown list in the top Kudu menu. - Except for changes in the shared storage, any change you make to the container from within the SSH session *doesn't* persist when your app restarts. These changes aren't part of the Docker image. To persist changes like registry settings and software installation, make them part of the Dockerfile. ## Access diagnostic logs App Service logs actions by the Docker host and activities from within the container. Logs from the Docker host (platform logs) are enabled by default. You need to manually enable application logs or web server logs from within the container. For more information, see [Enable application logging](troubleshoot-diagnostic-logs.md#enable-application-logging-linuxcontainer) and [Enable web server logging](troubleshoot-diagnostic-logs.md#enable-web-server-logging). You can access Docker logs in several ways: - [Azure portal](#azure-portal) - [Kudu](#kudu) - [Kudu API](#kudu-api) - [Azure Monitor](troubleshoot-diagnostic-logs.md#send-logs-to-azure-monitor) ### Azure portal Docker logs are displayed in the Azure portal in the **Container Settings** pane of your app. The logs are truncated. To download all the logs, select **Download**. ### Kudu To see the individual log files, go to `https://<app-name>.scm.azurewebsites.net/DebugConsole` and select the `LogFiles` folder. To download the entire `LogFiles` directory, select the **Download** icon to the left of the directory name. You can also access this folder by using an FTP client. By default, you can't access the `C:\home\LogFiles` folder in the SSH terminal because persistent shared storage isn't enabled. To enable this behavior in the console terminal, [enable persistent shared storage](#use-persistent-shared-storage). If you try to download the Docker log that's currently in use by using an FTP client, you might get an error because of a file lock. ### Kudu API Go directly to `https://<app-name>.scm.azurewebsites.net/api/logs/docker` to see metadata for the Docker logs. You might see more than one log file listed. You can use the `href` property to directly download the log file. To download all the logs together in one ZIP file, access `https://<app-name>.scm.azurewebsites.net/api/logs/docker/zip`. ## Customize container memory By default, all Windows containers deployed in Azure App Service have a memory limit configured. The following table lists the default settings per App Service plan SKU. | App Service plan SKU | Default memory limit per app (in MB) | |:-----|:-----| | P1v3 | 1024 | | P1Mv3 | 1024 | | P2v3 | 1536 | | P2Mv3 | 1536 | | P3v3 | 2048 | | P3Mv3 | 2048 | | P4Mv3 | 2560 | | P5Mv3 | 3072 | You can change this value by providing the `WEBSITE_MEMORY_LIMIT_MB` app setting in [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
The following table shows the possible values: | Value | Description | |:---|:---| | `Repair` | Restart the container after three consecutive availability checks. | | `ReportOnly` | The default value. Report the container in the Docker logs after three consecutive availability checks, but don't restart it. | | `Off` | Don't check for availability. | ## Support for group managed service accounts Group managed service accounts aren't supported in Windows containers in App Service. ::: zone-end ::: zone pivot="container-linux" ## Enable SSH You can use Secure Shell (SSH) to remotely run administrative commands from a command-line terminal. To enable the Azure portal SSH console feature with custom containers, follow these steps: 1. Create a standard `sshd_config` file with the following example contents and place it on the application project root directory:
Replace the following values:
- *\<app-name>* with the name of your web app.
> [!TIP]
> If you use PowerShell console to run the commands, escape the strings in the `--generic-configurations` argument in this step and the next step. For example: `--generic-configurations '{\"acrUseManagedIdentityCreds\": true'`.
1. (Optional) If your app uses a [user-assigned managed identity](overview-managed-identity.md#add-a-user-assigned-identity), make sure the identity is configured on the web app and then set the `acrUserManagedIdentityID` property to specify its client ID:
::: zone-end ::: zone pivot="container-linux" You can use the `/home` directory in your custom container file system to persist files across restarts and share them across instances. When you use the `C:\home` directory, your custom container can access persistent storage. Keep in mind that data that you save within `/home` contributes to the [storage space quota](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-app-service-limits) included with your App Service plan. When persistent storage is disabled, writes to the `C:\home` directory aren't persisted across app restarts or across multiple instances. When persistent storage is enabled, all writes to the `C:\home` directory persist. All instances of a scaled-out app can access them. When the container starts, if any files are present on the persistent storage, they overwrite any contents in the `C:\home` directory of the container. The only exception is the `C:\home\LogFiles` directory. This directory stores the container and application logs. The folder always persists upon app restarts if [application logging is enabled](troubleshoot-diagnostic-logs.md?#enable-application-logging-windows) with the **File System** option, whether or not persistent storage is enabled. In other words, when you enable or disable persistent storage, it doesn't affect application logging behavior. We recommend that you write data to `/home` or a [mounted Azure storage path](configure-connect-to-azure-storage.md?tabs=portal&pivots=container-linux). Data that you write outside these paths isn't persistent during restarts. The data is saved to platform-managed host disk space separate from the App Service plans file storage quota. By default, persistent storage is *disabled* on Linux custom containers. To enable it, set the `WEBSITES_ENABLE_APP_SERVICE_STORAGE` app setting value to `true` by using [Cloud Shell](https://shell.azure.com). In Bash, use the following command:
In PowerShell, use the following command:
> [!TIP] > Updating the app setting triggers automatic restart, which causes minimal downtime. For a production app, consider swapping it into a staging slot. Change the app setting in the staging slot, and then swap it back into production. To verify your adjusted number, open an SSH session by using the Azure portal or the Kudu portal (`https://<app-name>.scm.azurewebsites.net/webssh/host`). Enter the following commands by using PowerShell. Each command returns a number.
In PowerShell, use the following command: