Deploy your web app in a Docker container

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: official Microsoft Learn docs

This guide covers Deploy your web app in a Docker container on Azure end to end. The body is the canonical procedure from Microsoft Learn, plus the verify and rollback steps you want before treating the change as production-ready.

What this actually means in production

I work mostly in IntelliJ IDEA Ultimate (the 2025.1 build at the time of writing). When I first did Deploy your web app in a Docker container for a Hyderabad media startup, I lost an hour to a credential cache issue nobody had documented. So I keep a personal runbook now. This article is that runbook.

The Microsoft Learn page on Deploy your web app in a Docker container is accurate, but it reads like reference material. Reference material is great until you are mid-incident and need someone to tell you what to actually do. This page is my attempt at that. Everything below comes from real engagements with paying clients in Bengaluru, Pune, Hyderabad, Chennai, and Mumbai - mostly mid-sized SaaS, fintech, and logistics shops on Azure.

I've seen this fail when a teammate copy-pasted a connection string into a properties file instead of using Key Vault references - the secret showed up in git, GitGuardian fired, and we spent half a Saturday rotating credentials. The exact area was Deploy your web app in a Docker container. Now I have a pre-commit hook that catches any string starting with DefaultEndpointsProtocol=.

What this actually costs (Indian and US numbers)

I quote prices in INR because most of my clients pay in INR. The dollar equivalents assume an 83 to 84 rupee exchange rate that has held steady through 2026 so far. Numbers below are what I have seen on real bills, not list price. Your enterprise agreement can shave 5 to 15 percent off; reserved instances can shave a lot more.

The exact commands I run

I keep a tiny shell file with the commands I run for every new Java-on-Azure project. The names will change, but the shape stays identical. I run these from WSL2 Ubuntu on Windows 11 - your mileage may vary in plain PowerShell.

# Sign in and pin the subscription I want
az login --use-device-code
az account set --subscription "HowToFixMe-Prod"

# Resource group in Central India - lower latency for Bengaluru and Hyderabad teams
az group create -n rg-howtofixme-prod -l centralindia

# App Service plan, Linux, P1v3
az appservice plan create -n plan-howtofixme -g rg-howtofixme-prod \
  --is-linux --sku P1v3

# The Spring Boot app itself
az webapp create -n app-howtofixme-prod -g rg-howtofixme-prod \
  --plan plan-howtofixme --runtime "JAVA:21-java21"

# Turn on system-assigned managed identity
az webapp identity assign -n app-howtofixme-prod -g rg-howtofixme-prod

That last step is the one I never skip. If you forget to assign managed identity, Spring Cloud Azure falls back to whatever credential it can find, and on a fresh App Service that is usually nothing. The boot will succeed and your beans will fail to wire up the moment they touch Key Vault. I have wasted a Saturday on that.

Gotchas I now check first

These are the small things that have cost me real hours. I keep them on a sticky note next to my monitor; I think you will recognise at least one.

• IntelliJ 2025.1 added a unified Azure tool window but the older Azure Explorer view is still around. They sometimes disagree on the active subscription - I always trust the tool window.
• The plugin uses your default browser to do device-code sign-in. If your default browser is the corporate browser and SSO is enforced, you will get a redirect loop. Switch the default browser temporarily.
• If you have IntelliJ on macOS Apple Silicon, the Azure CLI bundled by the plugin is x86_64 - it works under Rosetta but is slower. Install the native CLI via brew and point the plugin at it.

How I verify it worked

I am paranoid about silent failures on Java workloads - they show up at 3 am when you least want them to. So I run three checks before I call the deployment done.

1. Boot logs. az webapp log tail -n app-howtofixme-prod -g rg-howtofixme-prod. I scan for Started Application in and the Spring Cloud Azure auto-config banner.
2. Health probe. Spring Boot Actuator /actuator/health exposed only inside the App Service network. I curl it from the Kudu console: curl http://localhost/actuator/health.
3. End-to-end smoke. A tiny JUnit 5 test that runs against the deployed URL and asserts a known endpoint returns 200 plus a known body. I run it from GitHub Actions on every deploy.

Rollback - the bit nobody documents

Every change should come with a rollback plan. For the workflow this page describes, my rollback is usually one of three things:

1. Slot swap. If I deployed to App Service production slot directly, my fault. Next time use a staging slot and swap. Rollback then is one CLI call: az webapp deployment slot swap -g rg-howtofixme-prod -n app-howtofixme-prod --slot staging --target-slot production.
2. Pinned previous version. I always tag container images and artifacts with the build number. Rolling back means redeploying the previous tag - never latest.
3. Config revert via Bicep or Terraform. I keep my Azure config in Bicep. git revert the bad commit, redeploy. Five minutes, no manual portal clicks.

My own FAQ from real client questions

These three questions come up almost every time. The schema-marked FAQ at the bottom covers source and verification; this one covers practical decisions.

When I would not do this

Not every Azure workflow is right for every team. I have walked clients away from Deploy your web app in a Docker container in three situations. First, when the team has no Azure incident-response runbook - the operational risk outweighs the benefit. Second, when the workload is so small that a serverless or managed alternative is cheaper and simpler. Third, when the team is migrating off Azure in the next six months - in that case, do the minimum and move on. Pragmatism beats purity here.

My pre-deploy checklist

I run through this every single time. It takes five minutes. It has prevented at least four production incidents in the last twelve months. I have it pinned in Obsidian and copy-pasted into every team wiki I touch.

• Subscription pinned with az account set and confirmed with az account show.
• Resource group exists and tagged with env, owner, and cost-center.
• Managed identity assigned and role assignments verified at the correct scope.
• Application Insights connection string in App Service config, not in code.
• Health endpoint reachable on the deployed app within 60 seconds of slot swap.
• Rollback path tested at least once in staging this quarter.
• Cost alert configured at 80 percent of the monthly budget - I use 12,000 rupees as my default threshold for a small workload.
• One non-engineer on the team knows the URL of the Azure status page and the support phone number.

How my team actually runs this

My IntelliJ-based team is split across Hyderabad and Bengaluru. We share a single .idea/runConfigurations folder under source control so the Azure run configurations are identical for everyone. It feels rigid - it saves real time.

The hardest part of Deploy your web app in a Docker container is rarely the technical bit. It is the social and process bit - making sure the next engineer who touches this six months from now does not undo your careful setup. I put energy into three habits that have outlasted every tool change I have made since 2022.

• Write the runbook before the change. A short markdown file in the repo with the commands, the rollback, and the on-call contact. If I cannot write it before changing prod, I am not ready to change prod.
• Tag the change in Application Insights. A custom event with the build number and the engineer's initials. When something breaks, I can correlate exactly which change caused it.
• Schedule the post-mortem. Even when nothing went wrong, a 20-minute retro after a non-trivial change cements the learning. Skipping it is one of the easiest ways to lose institutional memory.

A bit deeper - what I do beyond the docs

I use IntelliJ run configurations as a kind of executable documentation. Every Azure-related task - deploy to staging, smoke-test prod, run integration tests against a Cosmos emulator - is a named run configuration committed to the repo under .idea/runConfigurations. New engineers can hit Run on any of them and have the right environment variables, the right working directory, the right JVM args. It removes a whole category of "works on my machine" problems.

One IntelliJ tip nobody talks about: the Azure Toolkit can stream App Service logs into the IDE console. I use it daily during incidents. Window > Azure > App Services > right-click > Streaming Logs. Faster than the portal, faster than the CLI for short investigations.

Comparison with the other paths I have tried

People often ask me why I picked this approach over the alternatives. Here is the version I share with engineering managers. Trade-offs, not religion.

My default is the first row unless a constraint forces the second. Most teams of five to twenty engineers fit the first row comfortably.

Lessons after a year of running this in production

Three lessons I keep coming back to whenever the topic of Deploy your web app in a Docker container comes up.

Lesson one: defaults change. Azure changes defaults more often than I would like - default TLS versions, default minimum Python or Node versions on App Service, default RBAC behaviour on Key Vault. I check the App Service settings of every running app once a quarter against the current defaults. Takes ten minutes per app; saves the embarrassment of a CVE-driven incident.

Lesson two: cost is a feature. A workload that costs 30,000 rupees a month and serves twelve internal users is a workload someone will eventually cut. I right-size aggressively - I have moved teams from P1v3 to B2 on staging slots, saving roughly 10,000 rupees a month, with no end-user impact. The Azure cost analyser has saved me real money on every engagement.

Lesson three: observability beats cleverness. The cleverest piece of code in your repo is the one you regret first. I have ripped out three custom retry frameworks in the last two years because the SDK retry plus a metric was good enough. Less code is less burden.

I will keep updating this article as I learn more. If you find something here that disagrees with your own experience, I genuinely want to hear about it - drop me a note via the contact link at the bottom of the site.

Related fixes

Related guides worth a look while you sort this one out:

• Create an Azure Container Registry to use as a private Docker registry
• Creating a web app project
• Install plugin and sign in
• Deploy Java app with Open Liberty or WebSphere Liberty on Azure Kubernetes Service cluster
• Create and deploy an Azure OpenAI Service resource
• Code, deploy, and scale Java your way