Configure domains and DNS

The Domain & DNS page shows default and custom domains for a container. External requests use HTTPS; routing to the application uses HTTP. Each domain has its own internal HTTP port. For example, app.example.com can route to port 3000 while admin.example.com routes to port 8080 on the same container.

Adding, editing, deleting and refreshing domains requires container_engine.domains.manage. Viewing domains requires container_engine.domains.read.

Before you beginCopy Anchor Link

Deploy an HTTP application and identify its internal listening port. To add a custom domain, you must be able to edit DNS records for that hostname.

Configure the HTTP targetCopy Anchor Link

1. Open Domain & DNS on the container.
2. Select Edit on the domain to expand its inline editor, then set Internal HTTP port to the application's listening port. The port is required and must be an integer from 1 to 65535.
3. Select Save port. Only this domain and its connection check are updated.

For an application listening on port 3000, use 3000 here. This setting controls routing; it does not make the application start listening on a new port or publish a host port. Both default and custom domains can be edited. Changing a custom domain port does not bypass DNS verification.

Connect a custom domainCopy Anchor Link

1. Select Add domain, enter a hostname such as app.example.com and its required Internal HTTP port in the dialog, and select Add domain to confirm.
2. Expand DNS configuration for that domain. Copy the Value of its CNAME record. The Name column shows the full hostname; some DNS providers expect only the subdomain.
3. In your DNS provider, create a CNAME record for the custom hostname pointing to that target. Use the exact target from the Console, not a guessed server address.
4. Allow the DNS change to propagate. Connection checks start automatically and continue after you leave the page.
5. Wait for Valid Configuration, then open the HTTPS URL. If the check fails, correct the displayed issue and select Refresh.

Use Search domains to filter the list. Refresh beside a domain starts its connection check and reloads the list; Try again retries a failed list request. A failed add or edit keeps the hostname and port in the dialog for retry.

The generated domain hostname is read-only, but you can retry its connection check. For a custom hostname, choose a DNS name on which your provider allows a CNAME record.

Understand connection statusCopy Anchor Link

Generated and custom domains use the same connection checks. Registering a domain does not immediately mark it Valid Configuration.

• Checking: the connection check is queued or starting.
• Waiting for DNS: public DNS or the required custom-domain CNAME is not ready.
• Certificate Provisioning: HTTPS does not yet present a trusted, unexpired certificate for this hostname.
• Connecting: the endpoint is not responding yet, or returns HTTP 5xx. The response code, such as HTTP 502, appears separately.
• Valid Configuration: the last check received a response below HTTP 500 over trusted HTTPS. HTTP 401, 403 or 404 can still appear alongside this state: the domain is reachable, but the root URL may require authentication or have no application route. This is not an application health check.
• Failed: checking could not finish within ten minutes, or a configuration issue needs attention. Fix the indicated DNS, routing, port or certificate issue, then select Refresh.

While a check is pending, the page refreshes its status about every five seconds and shows a spinner. Checks of connected domains happen less frequently. Status changes are not instantaneous.

Refresh starts a new connection check. It does not restart the container or force certificate reissuance. An existing authorized route remains enabled while checks are pending or failed. If certificate errors persist, contact support with the resource ID, hostname and displayed error.

Remove a custom domainCopy Anchor Link

Select Edit for the domain, then Delete in its expanded panel and confirm. Remove its CNAME record from your DNS provider separately.

If verification or routing fails, follow Troubleshoot containers.