{"record":{"id":"4b350c1dc62d8da7","repo":"hashicorp/terraform","slug":"new-container-client-v","errorCode":null,"errorMessage":"new container client: %v","messagePattern":"new container client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":223,"sourceCode":"\n\tvar baseUri string\n\tif c.accountDetail != nil {\n\t\t// Use the actual blob endpoint if available\n\t\tpBaseUri, err := c.accountDetail.DataPlaneEndpoint(EndpointTypeBlob)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tbaseUri = *pBaseUri\n\t} else {\n\t\tbaseUri, err = naiveStorageAccountBlobBaseURL(c.environment, c.storageAccountName)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tcontainersClient, err := containers.NewWithBaseUri(baseUri)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"new container client: %v\", err)\n\t}\n\n\tswitch {\n\tcase c.sasToken != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Container Client from a SAS Token\")\n\t\tc.configureClient(containersClient.Client, nil)\n\t\tcontainersClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {\n\t\t\tif r.URL.RawQuery == \"\" {\n\t\t\t\tr.URL.RawQuery = c.sasToken\n\t\t\t} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {\n\t\t\t\tr.URL.RawQuery = fmt.Sprintf(\"%s&%s\", r.URL.RawQuery, c.sasToken)\n\t\t\t}\n\t\t\treturn r, nil\n\t\t})\n\t\treturn containersClient, nil\n\n\tcase c.accessKey != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Container Client from an Access Key\")","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/azure/api_client.go#L205-L241","documentation":"Thrown by getContainersClient when containers.NewWithBaseUri(baseUri) fails. Mirror of error 141 for the containers client (used by Workspaces() to enumerate state files). The baseUri validation rejects non-absolute or malformed URLs.","triggerScenarios":"First call to getContainersClient (typically from Workspaces, i.e. `terraform workspace list`). The constructed base URL is malformed: custom environment with empty/invalid storage domain suffix, private DNS blob endpoint returning an invalid URL, or storage_account_name with illegal characters.","commonSituations":"Sovereign cloud misconfigured; metadata_host returning wrong primaryEndpoints.blob; storage_account_name with underscores/uppercase/trailing whitespace.","solutions":["Verify storage_account_name is lowercase alphanumerics, 3-24 chars.","Check metadata_host / environment with TF_LOG=DEBUG.","Toggle lookup_blob_endpoint to control naive-vs-learned URL.","Run `terraform workspace list` again after fixing the underlying URL."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reuse the same base-URL validation as for the blob client.\nfunc validateContainerBaseURL(env environments.Environment, accountName string) error {\n    base, err := naiveStorageAccountBlobBaseURL(env, accountName)\n    if err != nil { return err }\n    u, err := url.Parse(base)\n    if err != nil { return fmt.Errorf(\"invalid container base url %q: %w\", base, err) }\n    if u.Scheme != \"https\" || u.Host == \"\" { return fmt.Errorf(\"container base url must be https with a host: %q\", base) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate storage_account_name with ^[a-z0-9]{3,24}$ before init.","Smoke-test the blob endpoint with curl for custom environments.","Run TF_LOG=DEBUG to inspect the resolved baseUri on first workspace-list."],"tags":["azure","container","url-parsing","configuration","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}