如何获取Azure容器实例的专属出站IP地址？

Absolutely, but the approach depends on how you've deployed your ACI instances. Let's break this down based on common scenarios:

Scenario 1: ACI deployed in a virtual network #

If you've placed your container instances into a custom Azure Virtual Network (VNet), you have direct control over the outbound IP:

• Assign a static public IP to your ACI during deployment. This IP is exclusive to your container group, so you can safely add it to your firewall allowlist.
• Alternatively, associate your VNet subnet with an Azure NAT Gateway that uses a static public IP. All outbound traffic from the ACI in that subnet will route through this fixed IP, which is also dedicated to your workloads.

Scenario 2: Default ACI deployment (no virtual network) #

In the default setup without a VNet, ACI uses dynamic public IPs pulled from Azure's regional shared IP pool. There's no official, filtered list of IPs reserved exclusively for ACI (the regional IP list you found covers all Azure services, as you noticed). Here are your workarounds:

• Migrate your ACI to a VNet and use one of the static IP methods above—this is the most reliable long-term solution for firewall configuration.
• If you need a temporary IP for testing, run a quick container command to fetch the current outbound IP, like:

  az container exec --resource-group <your-rg> --name <your-container> --exec-command "curl -s ifconfig.me"
  

  Keep in mind this IP might change if the container restarts or Azure refreshes the pool, so don't rely on it for permanent firewall rules.

Additional notes #

• If you're using Azure Service Endpoints or Private Links for internal services, your ACI's outbound traffic won't traverse the public internet—adjust your firewall rules to account for private network ranges instead.
• Static IPs for ACI must be configured at deployment time; you can't assign one to an existing container group after creation.

内容的提问来源于stack exchange，提问作者Jakub Złoczewski