Azure Container Registry (ACR): A Complete Guide

Compare containers with virtual machines to highlight improved resource efficiency and portability. Explain how containers share the host kernel, use namespaces and cgroups, and isolate applications with their own dependencies.

Discover how containers enable microservices by decomposing monoliths into scalable services like authentication, catalog management, and orders. See how portability and loose coupling boost flexibility and resilience in cloud deployments.

Create a simple containerized website using Nginx Alpine, build with a Dockerfile, push the image to Docker Hub, and run it locally with port 80 mapping.

Understand how a container registry, including Azure Container Registry, centralizes storage, versioning, and distribution of container images with security, access controls, and Kubernetes integration for scalable deployments.

Explore Azure Container Registry concepts such as registry, repository, image, artifact, tag, layer, manifest, digest, and namespaces, and learn how they relate to containers and image distribution.

Explore Azure Container Registry as a private, managed registry for storing and deploying container images, with security, OCI support, and RBAC integration across Azure services.

Define storage, throughput, and throttling in ECR, explain the 20 TB tier storage limit, and how read and write operations drive pulls and pushes.

Compare basic, standard, and premium ACR tiers, detailing features, storage limits, throughput, webhooks, and anonymous poll access.

Explore Azure pricing for ACR, including a free account with $200 credit and standard tier 100 gb storage with ten webhooks for free for 12 months, using the pricing calculator.

Explore the ECR policies and roadmap to understand the shared responsibility between Microsoft and customers for using the azure container registry correctly.

Create and explore your first Azure container registry in the portal, including resource group setup, basic sku selection, and key blades like get started, access control, and encryption.

Import images into Azure Container Registry from Docker Hub, other registries, or private sources with a simple workflow, then explore repositories, tags, and manifests, including multi-architecture images.

Enable and use the admin user in Azure Container Registry for quick image deployment to Azure services; manage two passwords, restrict use, and prefer individual accounts and other authentication methods.

Learn to create and package a helm chart, then push to and pull from Azure container registry using Helm 3, enabling deployment to Kubernetes clusters.

Build and run container images in the cloud with Azure Container Registry tasks—quick tasks—using az acr build and az acr run—without installing Docker on your machine.

Learn how to use Azure Cloud Shell with ACR and ECR, login with expose token, run ECR commands without the Docker daemon, and manage registries, images, and Helm.

Learn to route Azure Container Registry events to Event Grid and display them in near real-time on a prebuilt Azure Web App using ASP.NET Core and SignalR.

Explore ACR task concepts by examining yaml file formats, variables, aliases, and samples, and learn how run ID, timer schedules, and multi-step tasks automate builds and deployments.

Automate container image builds by committing source code to a git repository using ECR tasks, with a personal access token, environment variables, and automated task runs.

Automate Azure container deployments and updates using ACR task, ACR webhook, and Azure Logic Apps to provision and refresh an Azure container instance.

Create a multi-step task in Azure container registry with a YAML file to build, test, and push images, using Dockerfile, scripts, or commands and variables; trigger manually or on commits.

Automate container image builds with Azure Container Registry tasks when the base image updates, configuring base and app Dockerfiles, environment variables, and triggering builds from commits to the GitHub repository.

Schedule and run ACR tasks using timer triggers and cron expressions. Define minute, hour, day, month, and day-of-week; test timer-triggered tasks with image updates or code commits.

Learn how dedicated agent pools in Azure Container Registry reserve exclusive VM agents to run ACR tasks with configurable sizes and networking, scaled on demand and billed by CPU-seconds.

Learn to delete digests by timestamp in Azure container registry using a Microsoft script, including a dry run with enable delete set to false and final deletion of v1 manifests.

Lock images and repositories in Azure Container Registry to prevent delete, read, write, and list operations, and learn how mutable versus immutable tagging informs locking.

Enable soft delete to recover accidentally deleted artifacts in your registry, with a retention period of 1-90 days and auto purge every 24 hours.

Learn to use the ACR purge command to delete image tags and manifests on demand or on a schedule, with filters, go duration, untagged, dry run, and concurrency.

Set a retention policy for untagged manifests in premium Azure container registries to auto-delete manifests after 0–365 days, while untagged manifests are logged when deletion is disabled.

Learn how individual Active Directory identities authenticate and authorize access to container images in Azure Container Registry and why admin user access is discouraged in favor of granular rbac.

Learn to authenticate to Azure using managed identities, system and user assigned, with automatic credential rotation, and compare them to Azure AD service principals for ACR login and Docker pull.

Learn to use tokens and scope maps in Azure container registry to grant granular, time-limited access to repositories and images, with hands-on setup in the Azure portal.

Enable anonymous pull in Azure container registry to allow unauthenticated image downloads for public images, not available on basic tier, and requires standard or premium, with logout after enabling.

Explore ACR task authentication scenarios using system managed identities, cross-registry authentication, and Azure Key Vault secrets to securely access private repositories and pull base images across registries.

Explore Azure Kubernetes Service basics and running container images from ECR. Create an AKS cluster, manage pods and deployments, and expose apps with a load balancer.

Explore two AKS–ACR integration options: attach an ECR pull role to the cluster identity or create a docker registry secret for ECR credentials, enabling secure image pulls.

Configure a Kubernetes secret using a token to enable aks to pull images from acr with an image pull secret. Apply a pod yaml referencing the secret.

Deploy to Azure container instances with ECR admin user credentials, enable the admin user, and authenticate to pull container images securely from registries.

Learn to authenticate an Azure container instance to the Elastic Container Registry (ECR) with an Azure AD service principal, enabling least-privilege access, role assignments, and credential management for automated deployments.

Deploy a container from ECR to Azure App Service Web App for Containers using an admin user, enabling continuous deployment via a webhook that auto-updates on image changes.

Restrict public access to Azure container registry using the built-in firewall, define IP addresses or CIDRs, and explore how private endpoints and private link interact with trusted services.

Configure Azure Container Registry with private link, private endpoint, and private DNS zone to restrict traffic to an Azure virtual network and connect endpoints over the Microsoft backbone.

Understand how service endpoints in ACR route virtual network traffic over the Azure backbone, avoiding the public internet, and why private endpoints are recommended for private IP connectivity.

Enable secure access to azure container registry behind firewalls using dedicated data endpoints. Ensure registry rest Api and storage endpoints are reachable over port 443 to mitigate data exfiltration.

Configure an AKS cluster behind an Azure firewall, establish explicit egress via a route table and UDR, and permit access to the Azure container registry with network and application rules.

Microsoft Defender for Containers uses a Qualys-powered scanner to assess Azure container registry images for vulnerabilities and provide remediation and hardening recommendations.

Implement Azure policy for Azure container registries to enforce governance and security with append, audit, deny, and disabled effects, and test compliance for local admin accounts.

Learn how to disable artifact export in Azure container registry, enforce a network-restricted export policy to prevent leakage, test imports from ECR, and understand the security implications.

Learn Docker content trust basics and Azure Container Registry specifics: sign and verify images with root, repository, snapshot, and timestamp keys, and enable content trust for publishers and consumers.

Enable content trust in Azure container registry, sign images with docker trust, manage signers and keys, and verify signed versus unsigned images through push, pull, and inspection.

Learn how the az acr check-health command helps diagnose Docker and networking issues with Azure Container Registry, validating the Docker daemon, versions, DNS, and tokens.

Discover how Azure activity logs for ACR capture create, update, and delete actions, use Azure Monitor to build alerts, dashboards, and audits, and retain data for 90 days.

Explore Azure metrics with the Matrix Explorer in Azure Monitor to build custom charts and dashboards, set alerts, and analyze push/pull counts, storage use, and runtime duration for Azure resources.

Configure diagnostic settings for the Azure container registry and explore logs in a Log Analytics workspace, using Kusto queries to analyze registry and login events.

Learn how alerts monitor Azure resources using metrics, log, smart detection, and Prometheus alert types, with out-of-the-box and custom rules, action groups, and workflows to notify or automate resolution.

Understand geo replication in Azure container registry, mirroring container images across multiple regions to improve availability, reliability, and low-latency access for global users.

Enable geo replication in Azure container registry and deploy an app showing the image region. Test pull times between East US and West Europe VMs, noting reliability and data residency.

Project Teleport introduces a transport protocol that transfers container layers directly from registry to host, dramatically speeding image startup in Azure environments via SMB mounts and layer caching.

Understand how cache for ACR caches upstream images in Azure Container Registry to speed pulls. Learn benefits for private networks, rate-limit mitigation, and authenticated versus unauthenticated pull options.

Learn how to use cache for ACR to transparently cache Docker Hub images in your Azure Container Registry, enabling first pull from Docker Hub and subsequent pulls from the cache.

Learn to authenticate for ACR caching to securely pull from private repositories via authenticated pulls, preventing tampering, by configuring Azure Key Vault secrets and RBAC-driven credentials.