Ingress and app port mismatch

In the curl command below, we can deduce that the domain is reachable, but the connection is refused. One way to check is the containerapp ingress setting.

curl -s "https://$FQDN/health"

upstream connect error or disconnect/reset before headers. retried and the latest reset reason: remote connection failure, transport failure reason: delayed connect error: Connection refused%

Log shows that the app is listening to port 8000.

➜  aca-manage az containerapp logs show -n $CONTAINER_APP_NAME -g $RESOURCE_GROUP

{"TimeStamp": "2026-08-23T09:28:25.26863", "Log": "Connecting to the container 'ai-api'..."}
{"TimeStamp": "2026-08-23T09:28:25.29595", "Log": "Successfully Connected to container: 'ai-api' [Revision: 'ai-api--0000002', Replica: '[REDACTED]']"}
{"TimeStamp": "2026-08-23T09:23:57.1712251+00:00", "Log": "F [2026-08-23 09:23:57 +0000] [7] [INFO] Starting gunicorn 21.2.0"}
{"TimeStamp": "2026-08-23T09:23:57.1715836+00:00", "Log": "F [2026-08-23 09:23:57 +0000] [7] [INFO] Listening at: http://0.0.0.0:8000 (7)"}
{"TimeStamp": "2026-08-23T09:23:57.1716043+00:00", "Log": "F [2026-08-23 09:23:57 +0000] [7] [INFO] Using worker: sync"}
{"TimeStamp": "2026-08-23T09:23:57.1738285+00:00", "Log": "F [2026-08-23 09:23:57 +0000] [8] [INFO] Booting worker with pid: 8"}
{"TimeStamp": "2026-08-23T09:23:57.1775478+00:00", "Log": "F [2026-08-23 09:23:57 +0000] [9] [INFO] Booting worker with pid: 9"}
{"TimeStamp": "2026-08-23T09:27:29.2648703+00:00", "Log": "F [REDACTED] - - [23/Aug/2026:09:27:29 +0000] \"GET /health HTTP/1.1\" 200 21 \"-\" \"curl/7.81.0\""}

However, ingress setting properties.configuration.ingress shows that the targetPort is 3000, revealing a mismatch.

➜  aca-manage az containerapp show -n $CONTAINER_APP_NAME -g $RESOURCE_GROUP \
    --query "properties.configuration.ingress" -o yaml

The behavior of this command has been altered by the following extension: containerapp
additionalPortMappings: null
allowInsecure: false
clientCertificateMode: null
corsPolicy: null
customDomains: null
exposedPort: 0
external: true
fqdn: [REDACTED]
ipSecurityRestrictions: null
stickySessions: null
targetPort: 3000
targetPortHttpScheme: null
traffic:
- latestRevision: true
  weight: 100
transport: Auto

This commands updates the target port.

➜  aca-manage az containerapp ingress update -n $CONTAINER_APP_NAME -g $RESOURCE_GROUP \
    --target-port 8000

Ingress Updated. Access your app at https://[REDACTED]/

{
  "additionalPortMappings": null,
  "allowInsecure": false,
  "clientCertificateMode": null,
  "corsPolicy": null,
  "customDomains": null,
  "exposedPort": 0,
  "external": true,
  "fqdn": "[REDACTED]",
  "ipSecurityRestrictions": null,
  "stickySessions": null,
  "targetPort": 8000,
  "traffic": [
    {
      "latestRevision": true,
      "weight": 100
    }
  ],
  "transport": "Auto"
}

The endpoint now returns successful response.

➜  aca-manage curl -s "https://$FQDN/health"

{"status":"healthy"}