az webapp exec rejects Linux custom-container web apps whose kind is "linux,container"

Describe the bug

TLDR; I'm unable to connect to my linux container running on Azure App Service because I get the following error:
Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.

Details:

az webapp exec fails with "Site is not a Linux web app" for a Linux custom-container web app whose kind is linux,container. The site is a Linux web app by every other measure: it runs on a Linux App Service plan, reserved is true, siteConfig.linuxFxVersion is DOCKER|..., and the portal shows its operating system as Linux.

The check in webapp_exec.py calls is_linux_webapp, which first calls is_webapp. is_webapp requires the substring app in kind. Because linux,container doesn't contain app, the site is rejected before the linux check is reached.

For comparison, az webapp ssh decides with webapp.reserved, which is true for this site:

custom.py#L13079-L13082

Users can't work around this by correcting the kind. A PATCH that sets kind to app,linux,container succeeds, and the activity log records Microsoft.Web/sites/write as Succeeded, but a later GET still returns linux,container.

All six web apps in our resource group have this kind, so this likely affects other sites created the same way.

Site properties:

az webapp show -g <rg> -n <app> --query "{kind:kind, reserved:reserved, linuxFxVersion:siteConfig.linuxFxVersion}"
{
  "kind": "linux,container",
  "linuxFxVersion": "DOCKER|<registry>.azurecr.io/<image>:latest",
  "reserved": true
}

Failing command, debug output trimmed to the relevant lines:

az webapp exec --subscription <subscription-id> -g <rg> -n <app> --debug
DEBUG: cli.knack.cli: Command arguments: ['webapp', 'exec', '--subscription', '<subscription-id>', '--resource-group', '<rg>', '--name', '<app>', '--debug']
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
azure.cli.core.azclierror.ValidationError: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
ERROR: cli.azure.cli.core.azclierror: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.

Attempt to correct the kind, which is accepted but not applied:

az rest --method patch --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2024-04-01" --body '{\"kind\":\"app,linux,container\"}'

az webapp show -g <rg> -n <app> --query kind
"linux,container"

Related command

az webapp exec

Errors

Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.

Issue script & Debug output

Site properties:

az webapp show -g <rg> -n <app> --query "{kind:kind, reserved:reserved, linuxFxVersion:siteConfig.linuxFxVersion}"
{
  "kind": "linux,container",
  "linuxFxVersion": "DOCKER|<registry>.azurecr.io/<image>:latest",
  "reserved": true
}

Failing command, debug output trimmed to the relevant lines:

az webapp exec --subscription <subscription-id> -g <rg> -n <app> --debug
DEBUG: cli.knack.cli: Command arguments: ['webapp', 'exec', '--subscription', '<subscription-id>', '--resource-group', '<rg>', '--name', '<app>', '--debug']
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
azure.cli.core.azclierror.ValidationError: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
ERROR: cli.azure.cli.core.azclierror: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.

Attempt to correct the kind, which is accepted but not applied:

az rest --method patch --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2024-04-01" --body '{\"kind\":\"app,linux,container\"}'

az webapp show -g <rg> -n <app> --query kind
"linux,container"

Expected behavior

az webapp exec opens a shell in the app container, because the site is a Linux web app.

Environment Summary

azure-cli                         2.91.0

core                              2.91.0
telemetry                          1.1.0

Dependencies:
msal                              1.39.0
azure-mgmt-resource               24.0.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\<user>\.azure'
Extensions directory 'C:\Users\<user>\.azure\cliextensions'

Python (Windows) 3.14.7 (tags/v3.14.7:823f032, Aug  5 2026, 10:51:32) [MSC v.1944 64 bit (AMD64)]

Additional context

The check is unchanged on the dev branch at the commit linked above, and 2.91.0 is the latest release.

Thank you for opening this issue, we will look into it.

A Linux App Service custom-container site returned by the service as kind linux,container and reserved=true is rejected by az webapp exec as non-Linux, before the command reaches the container. The same rejection was reproduced in the Windows Server 2025 sandbox with CLI 2.91.0 and current dev. The command should accept this Linux site while continuing to reject non-Linux and non-webapp sites.

Important

Likely root cause (93% confidence): webapp_exec fetches the site then calls is_linux_webapp. That predicate calls is_webapp first, which requires the literal substring app in kind; kind linux,container fails that condition even when the site is reserved for Linux. The CLI throws ValidationError before reaching the SCM command execution.

📍 Affected code

File	Symbol	Line
`utils.py` _{src/azure-cli/azure/cli/command_modules/appservice}	`is_linux_webapp`	430
`webapp_exec.py` _{src/azure-cli/azure/cli/command_modules/appservice}	`webapp_exec`	66
`network_capture.py` _{src/azure-cli/azure/cli/command_modules/appservice}	`collect_network_capture`	34

🛠️ Proposed change

In appservice/utils.py, teach is_linux_webapp to recognize the specific Linux custom-container site kind even when it lacks app, using the Linux/reserved site signals while retaining logic/function and Windows exclusions. Keep is_webapp unchanged rather than altering other command classifications. Both exec and network capture then use the corrected shared predicate.

🚫 Ruled out

Configuration: The sandbox provisioned a Linux plan and a site with reserved=true and linux,container; the rejection depends on the returned kind, not a missing Linux plan setting.
Environment: The same preflight error occurred on the reported CLI, latest release and dev in the Windows Server 2025 sandbox; it happens before any local shell or container connection.
Intended behavior: The new exec command is meant to run on Linux web apps, and this site reports Linux plan and reserved=true; rejecting it solely for lacking app in kind is inconsistent with that restriction.

🧬 Origin

Introduced by: is_webapp comes from [App Service] functionapp deployment github-actions: Add new functionapp github-actions commands #23326 (2022-07-28); is_linux_webapp from [App Service] az webapp up: Add --track-status parameter to use deployment status API (#28235) #28235 (2024-01-25); exec from {App Service} az webapp exec: Add remote shell and command execution for Linux web apps #33640 (2026-08-05).
Original intent: The original helpers distinguish web apps from logic/function apps and Linux from Windows; the exec PR added remote shell and command execution for Linux web apps.
Does the fix keep that intent: Yes: allow only Linux custom-container web sites that the service reports without app in kind; keep function/logic and Windows sites excluded.

⏱️ Why this surfaced now

The 2026-08-05 addition of az webapp exec reused the older kind predicate, exposing its assumption for custom-container sites; the issue surfaced on CLI 2.91.0. No appservice-related dependency bump was evident in the reviewed year of dependency pin changes.

{App Service} az webapp exec: Add remote shell and command execution for Linux web apps #33640 added exec on 2026-08-05; {Release} Upgrade to Azure CLI 2.91.0 #34143 released CLI 2.91.0 on 2026-09-29.
The is_webapp lines still trace to [App Service] functionapp deployment github-actions: Add new functionapp github-actions commands #23326 and is_linux_webapp to [App Service] az webapp up: Add --track-status parameter to use deployment status API (#28235) #28235; network capture also reused the predicate in [App Service] az webapp troubleshoot collect network-capture: Add command to collect network capture #33949.

💥 Blast radius

Other callers: Two direct callers of is_linux_webapp: az webapp exec and az webapp troubleshoot collect network-capture; is_webapp separately classifies function apps for deployment validators.
Visible change for them: Both Linux-only commands would recognize linux,container sites without changing validation for function apps, logic apps or Windows sites.
Why not a narrower fix: A guard in webapp_exec alone leaves the same false rejection in network capture; changing is_webapp broadly would also affect unrelated function-app and deployment validation.

🔬 Technical details

Evidence

webapp_exec.py lines 60-67 fetch the site and raise the reported error if is_linux_webapp returns false.
utils.py lines 424-433 require app in kind before checking linux; linux,container contains linux but not app.
Sandbox run https://github.com/Azure/issue-sentinel/actions/runs/40469504371 provisioned a Linux B1 plan and linux,container site, then got the same error on release, latest and dev.

Test plan

Add an appservice tests/latest ScenarioTest that creates a Linux App Service plan and a custom-container site with kind linux,container (as in the sandbox), verifies the returned kind and reserved flag, waits for the container to start, and invokes az webapp exec --mode execute --command on it; assert the command reaches the container rather than merely avoiding the preflight error. The live-test lane must record the scenario after a successful run. Also cover normal app,linux, Windows, function/logic and Linux custom-container kinds with focused predicate tests, and exercise the network-capture guard with the same kind without mocking the predicate; existing mock-only webapp exec tests bypass this failure.

Generated code: Handwritten code. The predicate in appservice/utils.py and both callers are handwritten Python code outside aaz/ or generated clients.

Ask the Agent

Tick a box to queue an action. Requires write access to this repository.

🛠️ Ask the X Engineering Agent to fix this issue

Live reproduction (BAMI sandbox) — Reproduced

Verdict: Reproduced on the current build.

Version	Result	Evidence
2.91.0 (reported)	Reproduced	exit 1
2.91.0 (latest)	Reproduced	exit 1
dev @ `af86318`	Reproduced	exit 1

Steps run (redacted)

2.91.0 (reported)

setup: az appservice plan create -g <rg> -n <name1> --is-linux --sku B1 --location <location> -> exit 0
setup: az rest --method put --url https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<name2>?api-version=2024-04-01 --body '{"location": "<location>", "kind": "linux,container", "properties": {"serverFarmId": "/subscriptions/<sub>/resourceGroups/<rg...
repro: az webapp show -g <rg> -n <name2> --query {kind:kind,reserved:reserved} -o json -> exit 0
repro: az webapp exec -g <rg> -n <name2> --mode execute --command 'echo x' -> exit 1, matches the issue

2.91.0 (latest)

setup: az appservice plan create -g <rg> -n <name1> --is-linux --sku B1 --location <location> -> exit 0
setup: az rest --method put --url https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<name2>?api-version=2024-04-01 --body '{"location": "<location>", "kind": "linux,container", "properties": {"serverFarmId": "/subscriptions/<sub>/resourceGroups/<rg...
repro: az webapp show -g <rg> -n <name2> --query {kind:kind,reserved:reserved} -o json -> exit 0
repro: az webapp exec -g <rg> -n <name2> --mode execute --command 'echo x' -> exit 1, matches the issue

dev @ af86318

setup: az appservice plan create -g <rg> -n <name1> --is-linux --sku B1 --location <location> -> exit 0
setup: az rest --method put --url https://management.azure.com/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<name2>?api-version=2024-04-01 --body '{"location": "<location>", "kind": "linux,container", "properties": {"serverFarmId": "/subscriptions/<sub>/resourceGroups/<rg...
repro: az webapp show -g <rg> -n <name2> --query {kind:kind,reserved:reserved} -o json -> exit 0
repro: az webapp exec -g <rg> -n <name2> --mode execute --command 'echo x' -> exit 1, matches the issue

Sandbox run

Commands ran in an isolated Azure sandbox subscription from a validated ReproSpec; output is redacted.

_{X Engineering Agent · Fixer · react 👍 / 👎 to train the agent}

antcp

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc AzureAppServiceCLI (@AzureAppServiceCLI), antcp, @yutanglin16, @Azure/act-observability-squad.

antcp

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc AzureAppServiceCLI (@AzureAppServiceCLI), antcp, @yutanglin16, @Azure/act-observability-squad.

⏳ Queued — X Engineering Agent picked up this request and will post its findings here.

Navigation Menu

Repository navigation

az webapp exec rejects Linux custom-container web apps whose kind is "linux,container" #34226

Describe the bug

Related command

Errors

Issue script & Debug output

Expected behavior

Environment Summary

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

az webapp exec rejects Linux custom-container web apps whose kind is "linux,container" #34226

Description

Describe the bug

Related command

Errors

Issue script & Debug output

Expected behavior

Environment Summary

Additional context

Activity

yonzhan commented on Oct 14, 2026

x-engineering-agent commented on Oct 15, 2026

microsoft-github-policy-service commented on Oct 27, 2026

microsoft-github-policy-service commented on Oct 27, 2026

x-engineering-agent commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions