{"record":{"id":"f7cc24aed70a2098","repo":"microsoft/aspire","slug":"apphost-deploymentstatepathsha256-is-required-to-isolate","errorCode":null,"errorMessage":"AppHost:DeploymentStatePathSha256 is required to isolate Azure sandbox ownership between AppHosts.","messagePattern":"AppHost:DeploymentStatePathSha256 is required to isolate Azure sandbox ownership between AppHosts\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs","lineNumber":2002,"sourceCode":"    private static void SetPendingLegacyDeploymentCleanup(\n        DeploymentStateSection stateSection,\n        JsonObject? pendingDeploymentCleanup)\n    {\n        if (pendingDeploymentCleanup is null)\n        {\n            stateSection.Data.Remove(\"PendingLegacyDeploymentCleanup\");\n        }\n        else\n        {\n            stateSection.Data[\"PendingLegacyDeploymentCleanup\"] = pendingDeploymentCleanup.DeepClone();\n        }\n    }\n\n    internal static string GetStableAppHostIdentity(IConfiguration configuration)\n    {\n        return configuration[\"AppHost:DeploymentStatePathSha256\"] is { Length: > 0 } deploymentStatePathHash\n            ? deploymentStatePathHash\n            : throw new InvalidOperationException(\"AppHost:DeploymentStatePathSha256 is required to isolate Azure sandbox ownership between AppHosts.\");\n    }\n\n    internal static string CreateDeploymentSecurityFingerprint(\n        string immutableImageReference,\n        IReadOnlyList<SandboxEndpoint> endpoints,\n        IReadOnlyList<AzureDevComputeIdentitySetting>? identitySettings,\n        AzureDevComputeSandboxEgressPolicy egressPolicy)\n    {\n        ArgumentException.ThrowIfNullOrWhiteSpace(immutableImageReference);\n        ArgumentNullException.ThrowIfNull(egressPolicy);\n\n        return new JsonObject\n        {\n            [\"ImageReference\"] = immutableImageReference,\n            [\"Endpoints\"] = new JsonArray(\n                endpoints\n                    .OrderBy(static endpoint => endpoint.Name, StringComparer.Ordinal)\n                    .Select(static endpoint => (JsonNode)new JsonObject","sourceCodeStart":1984,"sourceCodeEnd":2020,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs#L1984-L2020","documentation":"GetStableAppHostIdentity reads the 'AppHost:DeploymentStatePathSha256' configuration value, which hashes the deployment-state path to isolate sandbox ownership between AppHosts. If the value is missing or empty, an InvalidOperationException is thrown because sandbox ownership cannot be determined safely.","triggerScenarios":"Running Azure sandbox deployment outside the normal AppHost pipeline (which normally injects AppHost:DeploymentStatePathSha256), or with a configuration source that drops this key.","commonSituations":"Custom host builders or test harnesses not wiring AppHost configuration; invoking deployment publishing APIs directly; older AppHost runtime not setting the new key.","solutions":["Run the deployment through the standard AppHost/publish pipeline so the key is populated","Set configuration key 'AppHost:DeploymentStatePathSha256' to the deployment state path hash before deploying","Update the AppHost runtime if it predates this configuration contract"],"exampleFix":"// before\nconfiguration[\"AppHost:DeploymentStatePathSha256\"] unset\n// after\nconfiguration[\"AppHost:DeploymentStatePathSha256\"] = Convert.ToHexString(System.IO.Hashing.XxHash3.Hash(KnownDeploymentStatePath));","handlingStrategy":"validation","validationCode":"if (string.IsNullOrEmpty(configuration[\"AppHost:DeploymentStatePathSha256\"]))\n    throw new InvalidOperationException(\"AppHost:DeploymentStatePathSha256 must be configured before sandbox deployment.\");","typeGuard":null,"tryCatchPattern":"try { DeploySandbox(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"DeploymentStatePathSha256\")) { /* run via standard AppHost pipeline or set the key */ }","preventionTips":["Always launch sandbox deployment via the standard AppHost pipeline","Don't strip AppHost:* configuration keys in custom hosts"],"tags":["azure","sandbox","config","state"],"backgroundTag":"missing-required-config-field","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}