Check the encoded payload size before using Linux Custom Script's inline script setting

Source facts

The Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. Microsoft Learn.

Applicability

Use this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.

DSE recommendation

Validate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.

Verification

Generate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.

Official references

Microsoft Learn: Custom Script Extension Version 2 for Linux. Source reviewed September 9, 2026.