How to remote debug a java application running on Azure App Service

Question

When browsing to Settings > Configuration > General Settings Microsoft is pretty clear in that it currently doesn't support remote debugging (Linux App Service Plan, Java 11 SE).

However, I was wondering if there still is way to accomplish this, in a more manual fashion. E.g. I am able to open up a debugging port with the following custom startup command.

java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 -jar /home/site/wwwroot/app.jar

Notice the log below, that states it is listening on 5005/TCP. As expected, however, this listening port is not getting forwarded by Microsoft's infrastructure.

Also, SSH is only available via browser, so there is no easy way to expose that port by forwarding it like so ssh [email protected] -L 5005:localhost:5005.

Any other idea how a remote debugging session might be achieved with Java?

2021-07-29T14:52:59.769816383Z: [INFO]    _____
2021-07-29T14:52:59.769851884Z: [INFO]    /  _  \ __________ _________   ____
2021-07-29T14:52:59.769857984Z: [INFO]   /  /_\  \___   /  |  \_  __ \_/ __ \
2021-07-29T14:52:59.769873185Z: [INFO]  /    |    \/    /|  |  /|  | \/\  ___/
2021-07-29T14:52:59.769878285Z: [INFO]  \____|__  /_____ \____/ |__|    \___  >
2021-07-29T14:52:59.924543150Z: [INFO]          \/      \/                  \/
2021-07-29T14:52:59.924549150Z: [INFO]  A P P   S E R V I C E   O N   L I N U X
[...]
2021-07-29T14:53:05.404068415Z: [INFO]  STARTUP_FILE=
2021-07-29T14:53:05.419701706Z: [INFO]  STARTUP_COMMAND=java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 -jar /home/site/wwwroot/app.jar
2021-07-29T14:53:05.419807209Z: [INFO]  No STARTUP_FILE available.
2021-07-29T14:53:05.419822210Z: [INFO]  Running STARTUP_COMMAND: java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 -jar /home/site/wwwroot/app.jar
2021-07-29T14:53:05.468409936Z: [ERROR]  Picked up JAVA_TOOL_OPTIONS: -Xmx1346M -Djava.net.preferIPv4Stack=true
2021-07-29T14:53:05.769742003Z: [INFO]  Listening for transport dt_socket at address: 5005
2021-07-29T14:53:15.032989100Z: [INFO]
2021-07-29T14:53:15.033937730Z: [INFO]    .   ____          _            __ _ _
2021-07-29T14:53:15.034646252Z: [INFO]   /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
2021-07-29T14:53:15.035378475Z: [INFO]  ( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
2021-07-29T14:53:15.035688785Z: [INFO]   \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
2021-07-29T14:53:15.082402455Z: [INFO]    '  |____| .__|_| |_|_| |_\__, | / / / /
2021-07-29T14:53:15.082444656Z: [INFO]   =========|_|==============|___/=/_/_/_/
2021-07-29T14:53:15.082450956Z: [INFO]   :: Spring Boot ::                (v2.5.3)
2021-07-29T14:53:15.082455556Z: [INFO]
2021-07-29T14:53:15.874610379Z: [INFO]  2021-07-29 14:53:15.853  INFO 122 --- [           main] c.s.r.RemoteDebuggingDemo1Application    : Starting RemoteDebuggingDemo1Application using Java 11.0.7 on 16f2213f1d06 with PID 122 (/home/site/wwwroot/app.jar started by root in /)
2021-07-29T14:53:15.889931561Z: [INFO]  2021-07-29 14:53:15.889  INFO 122 --- [           main] c.s.r.RemoteDebuggingDemo1Application    : No active profile set, falling back to default profiles: default
2021-07-29T14:53:26.797375136Z: [INFO]  2021-07-29 14:53:26.796  INFO 122 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 80 (http)
2021-07-29T14:53:26.919083170Z: [INFO]  2021-07-29 14:53:26.918  INFO 122 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2021-07-29T14:53:26.921537347Z: [INFO]  2021-07-29 14:53:26.919  INFO 122 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.50]
2021-07-29T14:53:27.704270105Z: [INFO]  2021-07-29 14:53:27.703  INFO 122 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
[...]

Answer 1

It is actually possible to remote debug a Java application on Azue Linux AppService, by tunneling through SSH. This was tested on premium App Service Plans. Somehow I never found a documentation suggesting that, so here we go:

1. You add an application setting JAVA_OPTS to your app

agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=127.0.0.1:8000

2. Create a remote-connection with azure cli, that creates a SSH port 1234 on your computer:

   az webapp create-remote-connection -g RG -n MY_APP -p 1234

3. Create a ssh Tunnel from this local SSH port to the remote debugging port in the appservice

   ssh -L 1235:127.0.0.1:8000 [email protected] -p 1234

4. You then can attach a debugger of your choice to the port 1235 on your local host: (Maybe eclipse, vscode, intellij)

   jdb -attach 1235

The tunnel goes from your computer -> remote-connection via az-cli -> SSH into appservice -> remotedebug port in appservice