Azure Container Registry (ACR): geo-replicated images for AKS

Store Docker images on Azure with geo-replication, content trust, and ACR Tasks for build-on-push.

Docker HostingIntermediate

Why

ACR geo-replication writes once and reads from the nearest region, cutting AKS pull latency globally without managing multiple registries. ACR Tasks build on git push or base image update, and content trust signs images for supply-chain integrity.

Docker is used by 59% of professional developers per the Stack Overflow 2024 survey. Docker Hub has 15M+ public images, and OCI image spec adoption means containers run identically across Docker, Podman, and containerd.

When

Use when running AKS across regions, when you need build-on-push without separate CI, or for regulated workloads needing image signing. Avoid Docker Desktop for production (license requires paid plan for 250+ employees) — use containerd or Podman.

Skip Docker for single-binary Go/Rust apps — a static binary + systemd is simpler.

How

1. Create with `az acr create -n myacr -g myrg --sku Premium --admin-enabled false` (Premium for geo-replication). 2. Login: `az acr login -n myacr`. 3. Tag `myacr.azurecr.io/myapp:tag`, push. 4. Add geo-replication: `az acr replication create -r eastus` and `-r westeurope`. 5. For AKS, attach the ACR with `az aks update -n myaks -g myrg --attach-acr myacr` to grant the kubelet identity AcrPull. 6. Enable ACR Tasks: `az acr task create -n buildtask --image myapp:{{.Run.ID}} --context https://github.com/me/repo --git-access-token $TOKEN`.

Example

# Create Premium ACR with geo-replication az acr create -n myacr -g myrg --sku Premium --admin-enabled false az acr replication create -n myacr -r eastus az acr replication create -n myacr -r westeurope # Build on git push az acr task create -n buildtask --registry myacr \ --image myapp:{{.Run.ID}} --context https://github.com/me/repo \ --git-access-token \${TOKEN} --file Dockerfile # Attach to AKS (grants kubelet identity AcrPull) az aks update -n myaks -g myrg --attach-acr myacr

Common Problems

⚠Basic SKU lacks geo-replication and content trust — upgrade to Premium for those features.
⚠Admin-enabled=true creates a weak admin credential; disable it and use IAM/managed identities.
⚠Geo-replication at $6/replica/month adds up — only replicate to regions with real AKS clusters.

Best Practices

✓Use Premium with geo-replication only for multi-region AKS; Basic/Standard for single-region.
✓Disable admin user (--admin-enabled false) and grant AcrPull via managed identity or --attach-acr.
✓Enable content trust (az acr config content-trust update --status enabled) and sign images with Notary v2.

FAQ

What is Azure Container Registry (ACR): geo-replicated images for AKS and what problem does it solve?

Store Docker images on Azure with geo-replication, content trust, and ACR Tasks for build-on-push. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Azure Container Registry (ACR): geo-replicated images for AKS in 5 minutes?

Two steps to run it: (1) Create with `az acr create -n myacr -g myrg --sku Premium --admin-enabled false` (Premium for geo-replication).; (2) Login: `az acr login -n myacr`.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Azure Container Registry (ACR): geo-replicated images for AKS?

The most frequent issue is: Basic SKU lacks geo-replication and content trust — upgrade to Premium for those features.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Azure Container Registry (ACR): geo-replicated images for AKS?

Best practices for Azure Container Registry (ACR): geo-replicated images for AKS include: Use Premium with geo-replication only for multi-region AKS; Basic/Standard for single-region.; Disable admin user (--admin-enabled false) and grant AcrPull via managed identity or --attach-acr.; Enable content trust (az acr config content-trust update --status enabled) and sign images with Notary v2.. The first one — "Use Premium with geo-replication only for multi-region AKS; Basic/Standard for single-region." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Azure Container Registry (ACR): geo-replicated images for AKS?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Azure Container Registry (ACR): geo-replicated images for AKS options offer a free tier — validate within free quota before scaling.