0Pricing
Cloud & IT Cert Prep · Lesson

Azure Container Registry

Build and push Docker images to a private Azure Container Registry, manage access with role assignments, and automate image builds with ACR Tasks.

Azure Container Registry is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Azure Container Registry?

Azure Container Registry (ACR) is a managed, private Docker registry service built on the open-source Docker Registry 2.0. It stores and manages container images and related artifacts (Helm charts, OCI artifacts) used by your Azure deployments. ACR integrates natively with Azure Kubernetes Service (AKS), Azure Container Instances (ACI), and App Service, enabling seamless image pull without managing credentials.

ACR Service Tiers

ACR offers three service tiers. Basic is cost-optimised for learning and low-throughput development with 10 GB storage and limited webhook support. Standard adds geo-replication capabilities and increased throughput — suitable for most production workloads. Premium includes geo-replication, content trust, private links, customer-managed keys, and the highest bandwidth — required for enterprise security requirements.

# Create a Premium ACR in East US
az acr create \
  --name mycontainerregistry \
  --resource-group MyRG \
  --location eastus \
  --sku Premium

# List ACR instances in the subscription
az acr list --query '[].{name:name, sku:sku.name, loginServer:loginServer}' -o table

Pushing Images to ACR

To push a Docker image to ACR, authenticate the Docker client, tag your local image with the ACR login server hostname, and push. The ACR login server URL follows the pattern <registryname>.azurecr.io. Authentication uses your Azure AD credentials via az acr login (for interactive use) or an ACR admin password or service principal for automated pipelines.

# Authenticate to ACR
az acr login --name mycontainerregistry

# Tag a local image for ACR
docker tag myapp:latest mycontainerregistry.azurecr.io/myapp:v1.0

# Push the image
docker push mycontainerregistry.azurecr.io/myapp:v1.0

# List images in the registry
az acr repository list --name mycontainerregistry -o table
az acr repository show-tags --name mycontainerregistry --repository myapp

ACR Tasks: Cloud-Based Builds

ACR Tasks let you build Docker images in the cloud without a local Docker daemon. A quick task (az acr build) sends your build context to ACR and runs the Dockerfile remotely, producing an image stored directly in the registry. Scheduled or trigger-based tasks can rebuild your image automatically when the base image is updated or when code is committed to GitHub, enabling a full container CI pipeline without a separate build agent.

# Quick task: build and push without local Docker
az acr build \
  --registry mycontainerregistry \
  --image myapp:v1.0 \
  . # build context (current directory with Dockerfile)

# Define a multi-step ACR Task triggered on commit
az acr task create \
  --name buildAndTest \
  --registry mycontainerregistry \
  --context https://github.com/myorg/myrepo.git \
  --file acr-task.yaml \
  --git-access-token <GITHUB_PAT>

Access Control with RBAC

ACR integrates with Azure RBAC for fine-grained access control. The built-in ACR roles include AcrPull (pull images only — for deployment services), AcrPush (pull and push — for CI/CD pipelines), and AcrDelete (manage image tags). Assign the AcrPull role to your AKS or App Service managed identity so containers can pull images without credentials stored anywhere.

# Grant AKS cluster's managed identity the AcrPull role
ACR_ID=$(az acr show --name mycontainerregistry --resource-group MyRG --query id -o tsv)
AKS_IDENTITY=$(az aks show --name myAKSCluster --resource-group MyRG \
  --query identityProfile.kubeletidentity.objectId -o tsv)

az role assignment create \
  --assignee $AKS_IDENTITY \
  --role AcrPull \
  --scope $ACR_ID

Geo-Replication for Global Deployments

Geo-replication (Premium tier) replicates your registry to multiple Azure regions. When AKS or ACI in a region pulls an image, it reads from the nearest replica instead of a remote registry, reducing latency and egress costs. Replication is transparent — the same image URI works globally, and ACR routes pull requests to the geographically closest replica automatically.

# Add a geo-replication to West Europe
az acr replication create \
  --name westeurope \
  --registry mycontainerregistry \
  --location westeurope

# List all replicas
az acr replication list \
  --registry mycontainerregistry \
  --query '[].{name:name, location:location, status:provisioningState}' -o table

Content Trust and Image Signing

Content trust (Premium tier) uses Docker Notary to ensure that only signed images can be pulled from the registry. When content trust is enabled on ACR, unsigned images are rejected. Signing is performed in the CI pipeline using the Docker Content Trust toolchain and a trusted key pair. This prevents supply-chain attacks where a malicious image is pushed and deployed to production.

# Enable content trust on the registry
az acr config content-trust update \
  --registry mycontainerregistry \
  --status enabled

# Sign an image when pushing (DOCKER_CONTENT_TRUST env var)
# export DOCKER_CONTENT_TRUST=1
# docker push mycontainerregistry.azurecr.io/myapp:v1.0
# (Docker prompts for signing key passphrase)

Vulnerability Scanning with Defender

Enable Microsoft Defender for Containers to automatically scan every image pushed to ACR for known OS and application layer vulnerabilities (CVEs). Defender produces a report listing vulnerabilities by severity (Critical, High, Medium, Low) and provides remediation guidance. You can configure policies to block deployment of images with critical vulnerabilities to AKS clusters via Azure Policy integration.

# Enable Defender for Containers on the subscription
az security pricing create \
  --name Containers \
  --tier Standard

# View vulnerability assessment results
az security assessment list \
  --query "[?contains(displayName, 'Container')].{name:displayName, status:status.code}" \
  -o table

Private Endpoint for ACR

For maximum security, disable ACR's public network access and connect to it exclusively via a private endpoint inside your VNet. This ensures container images are never transferred over the public internet — all pulls go through Azure's private backbone. Configure a private DNS zone (privatelink.azurecr.io) to resolve the registry hostname to the private IP address inside your VNet.

# Create a private endpoint for ACR
az network private-endpoint create \
  --name acr-private-endpoint \
  --resource-group MyRG \
  --vnet-name MyVNet \
  --subnet PrivateEndpointSubnet \
  --private-connection-resource-id \
    $(az acr show --name mycontainerregistry --query id -o tsv) \
  --group-id registry \
  --connection-name acrConnection

# Disable public access
az acr update \
  --name mycontainerregistry \
  --public-network-enabled false

Lifecycle Management: Purging Old Images

Without lifecycle management, container registries accumulate thousands of old image tags, consuming expensive storage. Use ACR purge tasks (a built-in timer task) to delete untagged manifests and tags older than a specified duration. Run purges on a schedule using az acr task create with the acr purge command, targeting specific repositories and keeping a minimum number of recent tags.

# Create a scheduled purge task: delete tags older than 30d
az acr task create \
  --name scheduledPurge \
  --registry mycontainerregistry \
  --cmd 'acr purge --filter myapp:.*  --ago 30d --keep 5 --untagged' \
  --schedule '0 1 * * *' \
  --context /dev/null

Integrating ACR with AKS

The simplest way to connect AKS to ACR is using the az aks update --attach-acr command, which grants the AKS managed identity the AcrPull role automatically. After attaching, Kubernetes pod specs reference images using only the full ACR hostname — no imagePullSecrets are required because AKS uses the managed identity for authentication transparently at the node level.

# Attach ACR to an existing AKS cluster
az aks update \
  --name myAKSCluster \
  --resource-group MyRG \
  --attach-acr mycontainerregistry

# Now pods can use ACR images without imagePullSecrets
# Example pod spec:
# spec:
#   containers:
#   - name: myapp
#     image: mycontainerregistry.azurecr.io/myapp:v1.0

Quick Check

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

Lesson Recap

In this lesson you learned: Azure Container Registry (ACR) is a managed private registry that stores Docker images, ACR Tasks enable cloud-based image builds without a local Docker daemon, and RBAC roles (AcrPull, AcrPush) control access for deployment services and CI/CD pipelines. Next up we explore Azure Container Instances.

Frequently asked questions

Is the “Azure Container Registry” lesson free?

Yes — the full text of “Azure Container Registry” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.

What will I learn in “Azure Container Registry”?

Build and push Docker images to a private Azure Container Registry, manage access with role assignments, and automate image builds with ACR Tasks. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cloud & IT Cert Prep?

No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Azure Container Registry” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cloud & IT Cert Prep lesson?

Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Azure Container Registry
  2. Azure Container Instances
  3. Kubernetes Concepts for Azure
  4. Deploying Workloads on AKS
← Back to Cloud & IT Cert Prep