Networking in Azure Container Apps environment

Azure Container Apps operate in the context of an environment, which runs its own virtual network. As you create an environment, there are a few key considerations that inform the networking capabilities of your container apps:

• Environment type
• Virtual network type
• Accessibility level

Environment selection

Container Apps has two different environment types, which share many of the same networking characteristics with some key differences.

For more information see Environment types.

Virtual network type

By default, Container Apps are integrated with the Azure network, which is publicly accessible over the internet and only able to communicate with internet accessible endpoints. You also have the option to provide an existing VNet as you create your environment instead. Once you create an environment with either the default Azure network or an existing VNet, the network type can't be changed.

Use an existing VNet when you need Azure networking features like:

• Network Security Groups
• Application Gateway integration
• Azure Firewall integration
• Control over outbound traffic from your container app
• Access to resources behind private endpoints in your virtual network

If you use an existing VNet, you need to provide a subnet that is dedicated exclusively to the Container App environment you deploy. This subnet isn't available to other services. For more information see Virtual network configuration.

Accessibility level

You can configure whether your container app allows public ingress or ingress only from within your VNet at the environment level.

Public network access

The public network access setting determines whether your container apps environment is accessible from the public Internet. Whether you can change this setting after creating your environment depends on the environment's virtual IP configuration. The following table shows valid values for public network access, depending on your environment's virtual IP configuration.

In order to create private endpoints on your Azure Container App environment, public network access must be set to Disabled.

Azure networking policies are supported with the public network access flag.

Ingress configuration

Under the ingress section, you can configure the following settings:

• Ingress: You can enable or disable ingress for your container app.

• Ingress traffic: You can accept traffic to your container app from anywhere, or you can limit it to traffic from within the same Container Apps environment.

• Traffic split rules: You can define traffic splitting rules between different revisions of your application. For more information, see Traffic splitting.

For more information about different networking scenarios, see Ingress in Azure Container Apps.

Inbound features

Outbound features

Tutorials

Environment security

You can fully secure your ingress and egress networking traffic workload profiles environment by taking the following actions:

• Create your internal container app environment in a workload profiles environment. For steps, refer to Manage workload profiles with the Azure CLI.

• Integrate your Container Apps with an Application Gateway.

• Configure UDR to route all traffic through Azure Firewall.

HTTP edge proxy behavior

Azure Container Apps uses an edge HTTP proxy that terminates Transport Layer Security (TLS) and routes requests to each application.

HTTP applications scale based on the number of HTTP requests and connections. Envoy routes internal traffic inside clusters.

Downstream connections support HTTP1.1 and HTTP2 and Envoy automatically detects and upgrades connections if the client connection requires an upgrade.

Upstream connections are defined by setting the transport property on the ingress object.

Portal dependencies

For every app in Azure Container Apps, there are two URLs.

The Container Apps runtime initially generates a fully qualified domain name (FQDN) used to access your app. See the Application Url in the Overview window of your container app in the Azure portal for the FQDN of your container app.

A second URL is also generated for you. This location grants access to the log streaming service and the console. If necessary, you may need to add https://azurecontainerapps.dev/ to the allowlist of your firewall or proxy.

Ports and IP addresses

The following ports are exposed for inbound connections.

IP addresses are broken down into the following types:

Next steps

• Ingress in Azure Container Apps