{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "slug": "dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet", "url": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/" }, "title": "Leave address-reuse headroom in an ACI subnet", "summary": "Why can a small Azure Container Instances subnet fail during container lifecycle operations?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:47+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 241, "potentially_affected": "Use this capacity check for ACI groups deployed into an Azure virtual network. Confirm current regional and networking prerequisites. Plan outbound connectivity separately using the documented supported configuration; a subnet-size review is not a complete network design.", "dse_recommendation": "Size the delegated subnet for lifecycle behavior, not just the present running-group count.", "primary_source": { "name": "Deploy container group to Azure virtual network - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s ACI virtual-network deployment guide recommends a subnet of at least /24, or 256 addresses. It warns that smaller subnets can produce subnet-full failures because ACI cannot release address mappings quickly enough for reuse, leaving containers unable to start, restart or stop. The subnet must be explicitly delegated before deployment and can contain only container groups. Microsoft Learn.

\n

Applicability

\n

Use this capacity check for ACI groups deployed into an Azure virtual network. Confirm current regional and networking prerequisites. Plan outbound connectivity separately using the documented supported configuration; a subnet-size review is not a complete network design.

\n

DSE recommendation

\n

Size the delegated subnet for lifecycle behavior, not just the present running-group count. Have the network owner reserve an appropriate address range and compare it with Microsoft’s current recommendation before rollout. Include planned creation, restart and replacement activity in the capacity discussion. Do not remove unrelated resources from a shared subnet to force it into the ACI design without a separate authorized migration. Keep subnet delegation and address availability visible in the deployment review.

\n

Verification

\n

In an approved representative environment, inspect the delegated subnet and observe the intended container creation and restart sequence. Retain subnet-full errors and group-state transitions if they occur. Confirm that lifecycle operations complete with the chosen allocation. Do not interpret a single successful deployment in a small subnet as evidence that repeated replacements will have sufficient address-reuse headroom.

\n

Official references

\n

Microsoft Learn: Deploy container group to Azure virtual network.

", "content_text": "Source facts\nMicrosoft’s ACI virtual-network deployment guide recommends a subnet of at least /24, or 256 addresses. It warns that smaller subnets can produce subnet-full failures because ACI cannot release address mappings quickly enough for reuse, leaving containers unable to start, restart or stop. The subnet must be explicitly delegated before deployment and can contain only container groups. Microsoft Learn.\nApplicability\nUse this capacity check for ACI groups deployed into an Azure virtual network. Confirm current regional and networking prerequisites. Plan outbound connectivity separately using the documented supported configuration; a subnet-size review is not a complete network design.\nDSE recommendation\nSize the delegated subnet for lifecycle behavior, not just the present running-group count. Have the network owner reserve an appropriate address range and compare it with Microsoft’s current recommendation before rollout. Include planned creation, restart and replacement activity in the capacity discussion. Do not remove unrelated resources from a shared subnet to force it into the ACI design without a separate authorized migration. Keep subnet delegation and address availability visible in the deployment review.\nVerification\nIn an approved representative environment, inspect the delegated subnet and observe the intended container creation and restart sequence. Retain subnet-full errors and group-state transitions if they occur. Confirm that lifecycle operations complete with the chosen allocation. Do not interpret a single successful deployment in a small subnet as evidence that repeated replacements will have sufficient address-reuse headroom.\nOfficial references\nMicrosoft Learn: Deploy container group to Azure virtual network.", "content_markdown": "## Source facts\n\nMicrosoft’s ACI virtual-network deployment guide recommends a subnet of at least /24, or 256 addresses. It warns that smaller subnets can produce subnet-full failures because ACI cannot release address mappings quickly enough for reuse, leaving containers unable to start, restart or stop. The subnet must be explicitly delegated before deployment and can contain only container groups. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet).\n\n## Applicability\n\nUse this capacity check for ACI groups deployed into an Azure virtual network. Confirm current regional and networking prerequisites. Plan outbound connectivity separately using the documented supported configuration; a subnet-size review is not a complete network design.\n\n## DSE recommendation\n\nSize the delegated subnet for lifecycle behavior, not just the present running-group count. Have the network owner reserve an appropriate address range and compare it with Microsoft’s current recommendation before rollout. Include planned creation, restart and replacement activity in the capacity discussion. Do not remove unrelated resources from a shared subnet to force it into the ACI design without a separate authorized migration. Keep subnet delegation and address availability visible in the deployment review.\n\n## Verification\n\nIn an approved representative environment, inspect the delegated subnet and observe the intended container creation and restart sequence. Retain subnet-full errors and group-state transitions if they occur. Confirm that lifecycle operations complete with the chosen allocation. Do not interpret a single successful deployment in a small subnet as evidence that repeated replacements will have sufficient address-reuse headroom.\n\n## Official references\n\n[Microsoft Learn: Deploy container group to Azure virtual network](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "url": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Leave address-reuse headroom in an ACI subnet", "item": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "url": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/", "headline": "Leave address-reuse headroom in an ACI subnet", "description": "Why can a small Azure Container Instances subnet fail during container lifecycle operations?", "abstract": "Why can a small Azure Container Instances subnet fail during container lifecycle operations?", "articleBody": "Source facts\nMicrosoft’s ACI virtual-network deployment guide recommends a subnet of at least /24, or 256 addresses. It warns that smaller subnets can produce subnet-full failures because ACI cannot release address mappings quickly enough for reuse, leaving containers unable to start, restart or stop. The subnet must be explicitly delegated before deployment and can contain only container groups. Microsoft Learn.\nApplicability\nUse this capacity check for ACI groups deployed into an Azure virtual network. Confirm current regional and networking prerequisites. Plan outbound connectivity separately using the documented supported configuration; a subnet-size review is not a complete network design.\nDSE recommendation\nSize the delegated subnet for lifecycle behavior, not just the present running-group count. Have the network owner reserve an appropriate address range and compare it with Microsoft’s current recommendation before rollout. Include planned creation, restart and replacement activity in the capacity discussion. Do not remove unrelated resources from a shared subnet to force it into the ACI design without a separate authorized migration. Keep subnet delegation and address availability visible in the deployment review.\nVerification\nIn an approved representative environment, inspect the delegated subnet and observe the intended container creation and restart sequence. Retain subnet-full errors and group-state transitions if they occur. Confirm that lifecycle operations complete with the chosen allocation. Do not interpret a single successful deployment in a small subnet as evidence that repeated replacements will have sufficient address-reuse headroom.\nOfficial references\nMicrosoft Learn: Deploy container group to Azure virtual network.", "datePublished": "2026-09-10T00:24:47+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-429-leave-address-reuse-headroom-in-an-aci-subnet/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Leave address-reuse headroom in an ACI subnet" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 241, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy container group to Azure virtual network - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet" } } ] } }