Pulling container image in My Azure WebApp for Container started failing recently.

[wei2eng]

Select Topic Area

Question

Body

The service had been working for a few weeks early. Then I noticed the site was down since Monday this week. And I found the log below.

I tried regenerating the PAT and carefully copied the new token to the service config. It still fails. Which leaded me to believe it's not PAT permission problem.

Anyone may know what the issue is?

[imTheoDoR]

Hi @wei2eng
it's possible that the PAT you generated doesn't have sufficient permissions to pull the image. I've experienced a similar issue in the past, and it turned out that the token was missing the required scopes.

[igor-kan]

your problem is (correct me if I am wrong) that Azure WebApp for Containers suddenly stopped pulling ghcr.io/<org>/<repo>:latest with:

Failed to pull image: ImagePullFailure

Troubleshooting Steps

1. Ensure PAT Has read:packages

   • Regenerate a PAT that includes:
     • read:packages
     • repo (if image is in a private repo)

2. Configure Web App Registry Credentials
   In the Azure Portal → Your Web App → Container settings:

   Registry:      Private Registry
   Server URL:    ghcr.io
   Username:      <GitHub username or org>
   Password:      <PAT with read:packages>
   Image and tag: <org>/<repo>:latest
   

   • Save & restart the Web App.

3. Local Validation

   echo "<PAT>" | docker login ghcr.io \
     --username "<username>" --password-stdin
   docker pull ghcr.io/<org>/<repo>:latest

   • Successful pull confirms credentials & image existence.

4. Check GitHub & Org Visibility

   • If the package is org-owned and private:
     • Org Settings → Packages → verify your user/PAT has “read” access.
   • Public packages should be pullable by anyone.

5. Network/Service Status

   • GitHub: https://www.githubstatus.com/
   • Azure: https://status.azure.com/

6. Inspect Web App Logs

   • Monitoring → Log Stream → enable Container logging for detailed errors.

[wei2eng]

Thanks for the info, @imTheoDoR and @igor-kan !

My app started working again today. I don't think it was the PAT issue. It may be some glitch in the way how my Azure WepApp for Container service was pulling the container from ghcr.

[emmaharper20]

Your log shows that the site cannot start because the container fails to pull the image. This means the system is not able to download the image from the registry. The problem may be wrong image name wrong tag or network block. Please check the image path and make sure access works.