Azure App Services Container Not Working

[samc1213]

What is the issue?

Tailscale fails to connect when running in an Azure App Service Linux container. The daemon starts but reports v4=false v6=false and SetNetworkUp(false), despite the container having a working 169.254.x.x link-local address and full outbound internet connectivity.

It also seems to be trying interactive login despite an auth key being provided. I've run "echos" to show that my auth key env var is indeed being provided.

Logs:

 2026/03/25 23:47:31 Program starting: v1.94.2-t2de4d317a, Go 1.25.5: []string{"/app/tailscaled",
  "--tun=userspace-networking", "--socks5-server=localhost:1055"}
  2026/03/25 23:47:31 logpolicy: using system state directory "/var/lib/tailscale"
  2026/03/25 23:47:31 dns: using "direct" mode
  2026/03/25 23:47:31 dns: using *dns.directManager
  2026/03/25 23:47:31 wgengine.NewUserspaceEngine(tun "userspace-networking") ...
  2026/03/25 23:47:31 dns: using dns.noopManager
  2026/03/25 23:47:31 link state: interfaces.State{defaultRoute=vnet0g17garsd
  ifs={vnet0g17garsd:[llu4]} v4=false v6=false}
  2026/03/25 23:47:33 magicsock: SetNetworkUp(false)
  2026/03/25 23:47:33 magicsock: disco key = d:46151fc1c2f8976d
  2026/03/25 23:47:33 Engine created.
  2026/03/25 23:47:33 got LocalBackend in 2.036s
  2026/03/25 23:47:33 Start
  2026/03/25 23:47:33 Backend: logs:
  be:5a1fb6a85aff89bb8952edf5a67f00fcab576b98deca5b5d33d34bb8c06728e5 fe:
  2026/03/25 23:47:33 control: setPaused(true)
  2026/03/25 23:47:33 Switching ipn state NoState -> NeedsLogin (WantRunning=false, nm=false)
  2026/03/25 23:47:33 health(warnable=wantrunning-false): error: Tailscale is stopped.
  2026/03/25 23:47:36 localapi: [POST] /localapi/v0/check-prefs
  2026/03/25 23:47:36 localapi: [POST] /localapi/v0/start
  2026/03/25 23:47:36 Start: updated prefs: Prefs{ra=true dns=true want=true routes=[]
  statefulFiltering=false tags=tag:webapi nf=on host="integral-web-api" update=check Persist=nil}
  2026/03/25 23:47:36 generating new machine key
  2026/03/25 23:47:36 machine key written to store
  2026/03/25 23:47:36 control: setPaused(true)
  2026/03/25 23:47:36 Switching ipn state NoState -> NeedsLogin (WantRunning=true, nm=false)
  2026/03/25 23:47:36 health(warnable=warming-up): error: Tailscale is starting. Please wait.
  2026/03/25 23:47:36 control: client.Shutdown ...
  2026/03/25 23:47:36 control: Client.Shutdown done.
  2026/03/25 23:47:36 localapi: [POST] /localapi/v0/login-interactive
  2026/03/25 23:47:36 StartLoginInteractiveAs("root"): url=false
  2026/03/25 23:47:36 control: client.Login(2)
  2026/03/25 23:47:41 health(warnable=warming-up): ok
  2026/03/25 23:48:06 timeout waiting for Tailscale service to enter a Running state

Steps to reproduce

I'm basically doing this

FROM docker.io/tailscale/tailscale:stable
tailscaled --tun=userspace-networking --socks5-server=localhost:1055 &
sleep 2
tailscale up --auth-key=$TAILSCALE_AUTHKEY --hostname=test-appservice --advertise-tags=tag:webapi --timeout=30s

Are there any recent changes that introduced the issue?

No response

OS

Linux

OS version

No response

Tailscale version

1.94.2-t2de4d317a

Other software

No response

Bug report

BUG-2d003c3ad8875cd88eae3f6c143f0aa3a937adbd441ba880e7471ca597bbdc41-20260326000732Z-ca1db29be7a98401

[samc1213]

After hacking around and setting APPSVC_RUN_ZIP and WEBSITE_STACK I think I may be able to get this to work. See

tailscale/hostinfo/hostinfo.go

Lines 364 to 370 in 330a17b

	func inAzureAppService() bool {
	if os.Getenv("APPSVC_RUN_ZIP") != "" && os.Getenv("WEBSITE_STACK") != "" &&
	os.Getenv("WEBSITE_AUTH_AUTO_AAD") != "" {
	return true
	}
	return false
	}

I'm still experimenting. I am currently using the newer sitecontainers deployment method on AAS.

[samc1213]

Confirmed that in the legacy docker mode and new sitecontainers mode this is an issue, and setting those environment vars manually fixes it. We could change that code to look for WEBSITE_INSTANCE_ID or something? Or there may be a more complex fix