Repository navigation
az webapp exec rejects Linux custom-container web apps whose kind is "linux,container" #34226
Description
Describe the bug
TLDR; I'm unable to connect to my linux container running on Azure App Service because I get the following error:
Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
Details:
az webapp exec fails with "Site is not a Linux web app" for a Linux custom-container web app whose kind is linux,container. The site is a Linux web app by every other measure: it runs on a Linux App Service plan, reserved is true, siteConfig.linuxFxVersion is DOCKER|..., and the portal shows its operating system as Linux.
The check in webapp_exec.py calls is_linux_webapp, which first calls is_webapp. is_webapp requires the substring app in kind. Because linux,container doesn't contain app, the site is rejected before the linux check is reached.
For comparison, az webapp ssh decides with webapp.reserved, which is true for this site:
Users can't work around this by correcting the kind. A PATCH that sets kind to app,linux,container succeeds, and the activity log records Microsoft.Web/sites/write as Succeeded, but a later GET still returns linux,container.
All six web apps in our resource group have this kind, so this likely affects other sites created the same way.
Site properties:
az webapp show -g <rg> -n <app> --query "{kind:kind, reserved:reserved, linuxFxVersion:siteConfig.linuxFxVersion}"
{
"kind": "linux,container",
"linuxFxVersion": "DOCKER|<registry>.azurecr.io/<image>:latest",
"reserved": true
}
Failing command, debug output trimmed to the relevant lines:
az webapp exec --subscription <subscription-id> -g <rg> -n <app> --debug
DEBUG: cli.knack.cli: Command arguments: ['webapp', 'exec', '--subscription', '<subscription-id>', '--resource-group', '<rg>', '--name', '<app>', '--debug']
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
azure.cli.core.azclierror.ValidationError: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
ERROR: cli.azure.cli.core.azclierror: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
Attempt to correct the kind, which is accepted but not applied:
az rest --method patch --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2024-04-01" --body '{\"kind\":\"app,linux,container\"}'
az webapp show -g <rg> -n <app> --query kind
"linux,container"
Related command
az webapp exec
Errors
Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
Issue script & Debug output
Site properties:
az webapp show -g <rg> -n <app> --query "{kind:kind, reserved:reserved, linuxFxVersion:siteConfig.linuxFxVersion}"
{
"kind": "linux,container",
"linuxFxVersion": "DOCKER|<registry>.azurecr.io/<image>:latest",
"reserved": true
}
Failing command, debug output trimmed to the relevant lines:
az webapp exec --subscription <subscription-id> -g <rg> -n <app> --debug
DEBUG: cli.knack.cli: Command arguments: ['webapp', 'exec', '--subscription', '<subscription-id>', '--resource-group', '<rg>', '--name', '<app>', '--debug']
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
azure.cli.core.azclierror.ValidationError: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
ERROR: cli.azure.cli.core.azclierror: Site is not a Linux web app. 'az webapp exec' is only supported for Linux web apps.
Attempt to correct the kind, which is accepted but not applied:
az rest --method patch --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<app>?api-version=2024-04-01" --body '{\"kind\":\"app,linux,container\"}'
az webapp show -g <rg> -n <app> --query kind
"linux,container"
Expected behavior
az webapp exec opens a shell in the app container, because the site is a Linux web app.
Environment Summary
azure-cli 2.91.0
core 2.91.0
telemetry 1.1.0
Dependencies:
msal 1.39.0
azure-mgmt-resource 24.0.0
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\<user>\.azure'
Extensions directory 'C:\Users\<user>\.azure\cliextensions'
Python (Windows) 3.14.7 (tags/v3.14.7:823f032, Aug 5 2026, 10:51:32) [MSC v.1944 64 bit (AMD64)]
Additional context
The check is unchanged on the dev branch at the commit linked above, and 2.91.0 is the latest release.
Activity
yonzhan commentedon Oct 14, 2026
Thank you for opening this issue, we will look into it.
x-engineering-agent commentedon Oct 15, 2026
X Engineering Agent Bug Analysis
Confidence: Low (0.40)
Below is my analysis of this issue:
Summary
Azure CLI 2.91.0 rejects az webapp exec for a reported Linux container site with kind linux,container and reserved=true. The site lookup succeeds, but the CLI rejects the site before opening a connection. The current dev source still contains this rejection path.
Likely root cause
The exec guard calls is_linux_webapp, which first calls is_webapp. That helper requires the substring app in kind, so linux,container is rejected without reaching the Linux check. This is a site-classification problem, not evidence of a failed container connection.
Affected code
src/azure-cli/azure/cli/command_modules/appservice/commands.py›load_command_table(line 322)src/azure-cli/azure/cli/command_modules/appservice/webapp_exec.py›webapp_exec(line 66)src/azure-cli/azure/cli/command_modules/appservice/utils.py›is_webapp(line 424)src/azure-cli/azure/cli/command_modules/appservice/utils.py›is_linux_webapp(line 430)Ruled out
Proposed change
Scope the correction to the Linux-site eligibility guard in webapp_exec.py. Preserve existing supported-site behavior and additionally recognize the reported Linux container shape using explicit kind tokens and Linux metadata, retaining Function App, Logic App and Windows exclusions. Avoid changing the shared helper without reviewing its network_capture.py caller and other consumers.
Technical details
Evidence
Test plan
Add focused regression cases in appservice/tests/latest/test_webapp_exec_thru_mock.py using actual site metadata and an unpatched classifier, while mocking connection/session boundaries. Cover linux,container with reserved=true, app,linux,container, Windows, Function App, Logic App and missing metadata. Confirm the affected case proceeds past validation without opening a real shell. If the shared helper changes, also cover network-capture classification. No HTTP recording is needed for these unit cases; a real container-session scenario remains unverified.
Generated code: Handwritten code. The failing guard and classifiers are handwritten appservice Python files, not AAZ or AutoRest-generated operations.
Out of scope: The live reproduction validator rejects az webapp exec as not an allowed reproduction command. No sandbox execution or interactive-session success is claimed; service-side kind persistence is a separate observation.
Live reproduction (BAMI sandbox) — Inconclusive
Verdict: Inconclusive: the sandbox could not run the reproduction to the end.
Reason: the problem cannot be expressed as allowed sandbox commands.
The analysis above is based on reading the code only, so its confidence is capped at low.
Commands ran in an isolated Azure sandbox subscription from a validated ReproSpec; output is redacted.
Posted by x-engineering-agent (Fixer)