Azure Container Registry stores OCI container images and artifacts. Azure Container Apps runs containerized HTTP services, event-driven workers, and jobs on a managed application platform without requiring you to operate Kubernetes directly. Use managed identity for image pulls and service access, pin immutable image digests, and keep secrets out of images.
Lab: 45–60 minutes · Cost: registry storage/builds, Container Apps compute, logs, networking, and dependent services can charge · Cleanup: delete the lab group.
Build once. Promote the same digest from test to production. Rebuilding from the same source can produce a different artifact because dependencies and base images change.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Open Container registries → Create. Choose SKU, network access, encryption, retention, and admin-user policy. Keep the registry admin account disabled; use Entra identities and repository-scoped permissions where supported. Use Repositories and Tasks to inspect images and builds without exposing credentials.
Create an environment, app, and identity using the current CLI extension and documentation. A compact learning flow is:
For production, configure a managed identity with AcrPull, private registry/network access, internal ingress where appropriate, secrets from Key Vault, health probes, resource limits, and diagnostic settings.
A revision is an immutable snapshot of app configuration. In multiple-revision mode, send a small percentage of traffic to a new revision, observe it, then increase or roll back. Label revisions for stable test URLs.
Revision rollback does not undo database writes. Use compatible contracts and expand/migrate/contract database changes.
Use a job for finite work that starts manually, on a schedule, or from an event and then exits. Examples: document indexing, report generation, migration, and batch evaluation. Set retries, replica timeout, parallelism, completion count, and idempotency deliberately.
HTTP apps can scale on requests/concurrency. Event-driven apps use KEDA-based scalers such as queue depth. Set maximum replicas to protect downstream databases and AI quotas. A scale-to-zero system may have cold-start latency; keep minimum replicas when latency matters.
Bicep and Terraform should create registry, private endpoints, identities, role assignments, Container Apps environment, app/job, log destination, and alerts. CI should: