{"record":{"id":"4b350c1dc62d8da7","repo":"hashicorp/terraform","slug":"new-container-client-v","errorCode":null,"errorMessage":"new container client: %v","messagePattern":"new container client: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/api_client.go","lineNumber":223,"sourceCode":"\n\tvar baseUri string\n\tif c.accountDetail != nil {\n\t\t// Use the actual blob endpoint if available\n\t\tpBaseUri, err := c.accountDetail.DataPlaneEndpoint(EndpointTypeBlob)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tbaseUri = *pBaseUri\n\t} else {\n\t\tbaseUri, err = naiveStorageAccountBlobBaseURL(c.environment, c.storageAccountName)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tcontainersClient, err := containers.NewWithBaseUri(baseUri)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"new container client: %v\", err)\n\t}\n\n\tswitch {\n\tcase c.sasToken != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Container Client from a SAS Token\")\n\t\tc.configureClient(containersClient.Client, nil)\n\t\tcontainersClient.Client.AppendRequestMiddleware(func(r *http.Request) (*http.Request, error) {\n\t\t\tif r.URL.RawQuery == \"\" {\n\t\t\t\tr.URL.RawQuery = c.sasToken\n\t\t\t} else if !strings.Contains(r.URL.RawQuery, c.sasToken) {\n\t\t\t\tr.URL.RawQuery = fmt.Sprintf(\"%s&%s\", r.URL.RawQuery, c.sasToken)\n\t\t\t}\n\t\t\treturn r, nil\n\t\t})\n\t\treturn containersClient, nil\n\n\tcase c.accessKey != \"\":\n\t\tlog.Printf(\"[DEBUG] Building the Container Client from an Access Key\")","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/azure/api_client.go#L205-L241","documentation":"In getContainersClient the backend derives a blob base URI (either from the looked-up account detail endpoint or from a naive guess) and then calls containers.NewWithBaseUri(baseUri). This error (api_client.go:221-223) means the resulting URI was empty or unparseable, so the Giovanni containers client could not be constructed. It is a configuration/endpoint-resolution failure rather than a network failure.","triggerScenarios":"Produced when containers.NewWithBaseUri(baseUri) returns an error because baseUri is empty or malformed. baseUri comes from either accountDetail.DataPlaneEndpoint(EndpointTypeBlob) (which can be nil/empty if the account has no blob endpoint) or naiveStorageAccountBlobBaseURL, which fails separately when the environment has no storage domain suffix.","commonSituations":"Using a sovereign/air-gapped cloud whose environment definition has no storage domain suffix; the storage account's PrimaryEndpoints.Blob is nil (account not fully provisioned, or non-StorageV2 with no blob endpoint); an invalid environment name or metadata_host that resolves to an environment lacking storage endpoints.","solutions":["Enable endpoint lookup so the real blob endpoint is fetched: set lookup_blob_endpoint = true and resource_group_name","Verify the environment matches your cloud: use environment = \"usgovernment\" / \"china\" / \"public\", or set metadata_host","Confirm the storage account exposes a blob endpoint: az storage account show -n <account> --query primaryEndpoints.blob","For air-gapped clouds, ensure the metadata service exposes a storage domain suffix"],"exampleFix":"// before: naive endpoint guess fails on a sovereign cloud\nterraform {\n  backend \"azurerm\" {\n    storage_account_name = \"mystorage\"\n    container_name       = \"tfstate\"\n    key                  = \"prod.tfstate\"\n    environment          = \"usgovernment\"\n  }\n}\n\n// after: look up the real blob endpoint via ARM\nterraform {\n  backend \"azurerm\" {\n    storage_account_name  = \"mystage\"\n    container_name        = \"tfstate\"\n    key                   = \"prod.tfstate\"\n    environment           = \"usgovernment\"\n    lookup_blob_endpoint  = true\n    resource_group_name   = \"rg-tfstate\"\n    subscription_id       = \"00000000-0000-0000-0000-000000000000\"\n  }\n}","handlingStrategy":"validation","validationCode":"# Validate the blob endpoint resolves before terraform init\nBLOB=$(az storage account show -n \"$ARM_STORAGE_ACCOUNT_NAME\" --query primaryEndpoints.blob -o tsv 2>/dev/null)\n[ -n \"$BLOB\" ] && echo \"OK blob endpoint: $BLOB\" || echo \"FAIL: no blob endpoint -> set lookup_blob_endpoint=true + resource_group_name\"\n# for sovereign clouds confirm the environment has a storage suffix\naz cloud show --query suffixes.storageEndpoint -o tsv","typeGuard":null,"tryCatchPattern":null,"preventionTips":["For sovereign/private-DNS clouds, always set lookup_blob_endpoint = true with resource_group_name","Verify the environment name or metadata_host resolves a storage domain suffix","Confirm the storage account has a blob endpoint before init"],"tags":["azure","configuration","storage","endpoint","sovereign-cloud"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}