Azure Container Registry (ACR)

Private Docker registry with geo-replication, content trust (signed images), vulnerability scanning (via Defender), and webhook-triggered tasks.

AzureBeginner

Why

ACR keeps your images private and close to your Azure compute (AKS, App Service, ACI) for fast pulls over the Azure backbone. Premium tier geo-replicates to multiple regions so AKS pulls from a local replica.

Defender integration scans images on push for CVEs.

When

Use ACR for any private images deployed to Azure. Use Premium for geo-replication or content trust; Basic/Standard suffice for single-region.

Compare with Docker Hub private repos (limited free) and GHCR (free for public, paid for private) — ACR is cheapest when pulls stay in Azure.

How

1. Create an ACR (Basic, Standard, or Premium). 2. az acr login to authenticate. 3. Tag images as <acr-login-server>/image:tag and docker push. 4. Attach to AKS with az aks update --attach-acr so AKS can pull without secrets. 5. Enable admin account only for quick tests; use Managed Identity or RBAC for prod. 6. (Premium) Enable geo-replication, content trust, and Defender scanning. ```bash az acr create --name myacr --resource-group rg --sku Standard az acr login --name myacr docker tag app:v1 myacr.azurecr.io/app:v1 docker push myacr.azurecr.io/app:v1 az aks update --name myaks --resource-group rg --attach-acr myacr ```

Example

ACR task that builds an image on every git push (CI without a separate pipeline): ```bash az acr task create --name buildapp --registry myacr \ --image app:{{.Run.ID}} \ --context https://github.com/contoso/app#main \ --file Dockerfile \ --git-access-token \${GH_PAT} # trigger manually az acr task run --name buildapp --registry myacr ``` List and pull the built image from AKS: ```bash az acr repository list --name myacr --output table kubectl run app --image=myacr.azurecr.io/app:42 ```

Common Problems

⚠docker push denied — you are not logged in or lack the AcrPush role; run az acr login or assign AcrPush/AcrPull to your identity.
⚠AKS ImagePullBackOff — ACR not attached; run az aks update --attach-acr myacr, or create an imagePullSecret with the ACR admin creds (less secure).
⚠Pull is slow from a distant region — use Premium geo-replication to mirror images near each AKS cluster, so pulls go to the local replica.

Best Practices

✓Use ACR Tasks for build-on-push CI — it builds in Azure near the registry, avoiding local Docker builds and slow pushes of large layers.
✓Enable Microsoft Defender for Containers to scan every pushed image for CVEs and block deploys of vulnerable images via admission policy.
✓Use content trust (Premium) to sign images and require AKS to pull only signed images, preventing tampered images from running.

FAQ

What is Azure Container Registry (ACR) and what problem does it solve?

Private Docker registry with geo-replication, content trust (signed images), vulnerability scanning (via Defender), and webhook-triggered tasks. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Azure Container Registry (ACR) in 5 minutes?

Two steps to run it: (1) Create an ACR (Basic, Standard, or Premium).; (2) az acr login to authenticate.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Azure Container Registry (ACR)?

The most frequent issue is: docker push denied — you are not logged in or lack the AcrPush role; run az acr login or assign AcrPush/AcrPull to your identity.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Azure Container Registry (ACR)?

Best practices for Azure Container Registry (ACR) include: Use ACR Tasks for build-on-push CI — it builds in Azure near the registry, avoiding local Docker builds and slow pushes of large layers.; Enable Microsoft Defender for Containers to scan every pushed image for CVEs and block deploys of vulnerable images via admission policy.; Use content trust (Premium) to sign images and require AKS to pull only signed images, preventing tampered images from running.. The first one — "Use ACR Tasks for build-on-push CI — it builds in Azure near the registry, avoiding local Docker builds and slow pushes of large layers." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Azure Container Registry (ACR)?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Azure Container Registry (ACR) options offer a free tier — validate within free quota before scaling.