In our previous blog, we explored the basics of Azure Container Apps and how they can transform your cloud-native application deployments. Now, it’s time to dig a little deeper into one of the key components that make this magic possible: Azure Container Registry (ACR). Whether you’re a developer looking to streamline your deployment process or an IT professional tasked with managing containerized applications, understanding how to configure and use ACR is essential. In this post, I’ll walk you through the steps to set up ACR, push your first container image, and secure your registry, ensuring you’re fully equipped to deploy applications with confidence

What is Azure Container Registry?

Azure Container Registry is a fully managed service based on the open-source Docker Registry 2.0. It’s designed to store and manage your container images and related artifacts securely and efficiently. Think of it as your personal repository where all your container images live—ready to be deployed across various Azure services like Azure Kubernetes Service (AKS), Azure App Service, or Azure Container Apps.

Here’s why you’ll love using Azure Container Registry:

Security Features: With Azure Active Directory (AAD) integration and other security measures, you can rest easy knowing your images are safe and access is well-controlled.

Centralized Management: ACR gives you a secure, scalable, and reliable space to store all your container images. No more worrying about where your images are or how they’re being managed.

Seamless Integration: ACR integrates smoothly with other Azure services, making it easier to implement continuous integration and continuous deployment (CI/CD) pipelines.

Azure Container Registry and Its Role in Container App Deployments

So, what role does Azure Container Registry play in container app deployments? Simply put, it’s the backbone of your container strategy on Azure. When you’re deploying applications, you need a reliable and secure place to store your Docker images. This is where ACR comes in. It acts as the source of truth for your images—whether you’re deploying them to AKS, App Service, or Azure Container Apps.

Here’s how it typically works:

• Developers push their Docker images to ACR.
• When it’s time to deploy, the deployment service (like Azure Container Apps) pulls the latest version of the image from ACR.
• If something goes wrong, versioning and tagging features in ACR allow you to roll back to a previous image version with ease.

By centralizing your image management, ACR helps you maintain consistency across your deployments, making it easier to manage and scale your applications.

How to Create and Configure an Azure Container Registry?

Step 1: Prerequisites

Before we start, ensure you have the following:

1. Azure Account: You need an active Azure account. If you don’t have one, you can create a free account with a $200 credit for the first 30 days.
2. Azure CLI: Install the Azure CLI to interact with Azure services from your terminal. Alternatively, you can use the Azure Portal for a more graphical interface.

Step 2: Creating a Container Registry

The first step in deploying a container app is to create an Azure Container Registry (ACR). This is where your container images will be stored and managed.

1. Create the Registry:
   • Open the Azure Portal and navigate to “Container Registries.”
   • Click on “Create” and fill in the necessary details:
     • Subscription: Select your Azure subscription.
     • Resource Group: Create a new resource group or use an existing one.
     • Registry Name: Choose a unique name for your registry. It must be unique within Azure and contain 5-50 alphanumeric characters. No special characters are allowed (including “-“, “_”, and “.”).
     • Location: Select the region closest to your users. The location specified should match the location/region specified for other resources in your solution, such as virtual networks and other container resources.
     • The availability zones option is a high-availability offering that provides resiliency and high availability to a container registry in a specific region.
     • SKU: For most use cases, the Basic SKU will suffice.
     • The Pricing plan is used to select the performance level and capabilities required. Premium registries provide the highest amount of included storage and concurrent operations, enabling high-volume scenarios. A premium tier is required for Private links with private endpoints to restrict access to the registry (and other advanced features).
     • Access Control: Use Azure Active Directory (AAD) to manage who can push or pull images. This adds an extra layer of security by ensuring that only authorized users can interact with your registry.
     • Networking: If your registry needs to be accessible only from specific virtual networks, configure the necessary network rules.
     • Geo-Replication (Optional): If you’re deploying globally, consider enabling geo-replication (available with the Premium SKU) to reduce latency by serving your images from the closest geographic location.
   • Click “Review + Create” and “Create” to set up your registry.

With your registry set up and configured, you’re ready to start pushing images!

Important commands for Registry Operations and image management

Pushing your first image to Azure Container Registry is straightforward. Here’s how you do it:

1. Log in to the container registry and Push an image to the registry

You must log in to the registry before pushing and pulling container images.

az acr login --name mycontainerregistry

Push an image to the container registry

Steps to push an image include create, tag, push, and remove local.

docker pull mcr.microsoft.com/hello-world
docker tag mcr.microsoft.com/hello-world myacr.azurecr.io/hello-world:v1
docker push myacr.azurecr.io/hello-world:v1
docker rmi myacr.azurecr.io/hello-world:v1

2. Pull and remove registry images

Use Docker and Azure commands to pull and remove images.

docker pull myacr.azurecr.io/hello-world:v1
az acr repository delete --name myacr --image hello-world:v1

Authentication Methods and Security Features of Azure Container Registry

Security is a big deal when dealing with container images, and Azure Container Registry has you covered with several robust features:

1. Azure Active Directory (AAD) Integration:
   • With AAD, you can manage who has access to your registry. You can define roles such as owners, contributors, or readers, giving you granular control over who can push, pull, or manage images.
2. Managed Identities:
   • Managed Identities allow your Azure resources to securely access ACR without needing credentials in your code. This minimizes the risk of credential exposure and simplifies security management.
3. Content Trust:
   • Content Trust ensures that your images are signed and verified before they’re pulled from the registry. This protects you from tampered images and ensures that only trusted images are deployed.
4. Private Link:
   • Use Azure Private Link to restrict access to your registry via a private endpoint within your virtual network. This prevents your registry from being exposed to the public internet, adding an extra layer of security.

By leveraging these security features, you can ensure that your container images are protected, and your deployments are secure.There are several ways to authenticate with container registry instances, each of which applies to one or more usage scenarios. Recommended ways to authenticate:

• Authenticate directly using an individual login
• Authenticate using a service principal
• Authenticate using a managed identity

Managed identities for Azure resources can be used to authenticate to an Azure container registry from another Azure resource, without needing to provide or manage registry credentials.You can create a user-assigned managed identity and assign it to one or more Azure Resources. When you enable a user-assigned managed identity:

• A service principal of a special type is created in Microsoft Entra ID for the identity. The service principal is managed separately from the resources that use it.
• Multiple resources can use the managed identity.
• You authorize the managed identity to have access to one or more services.

To create a user-assigned managed identity with Azure CLI, use the az identity create command:

 az identity create -g RG1 -n myacr

You can also create user-assigned assigned managed Identity on Azure Portal:

Conclusion

By now, you should have a comprehensive understanding of how to set up, configure, and secure an Azure Container Registry for your containerized applications. ACR not only provides a robust platform for managing your container images but also integrates seamlessly with other Azure services, enabling streamlined and secure deployment workflows. In the next part of this series, we’ll dive into configuring a container app within Azure Container Apps. This will include setting up environments, managing ingress, scaling your app, and more. Stay tuned for a hands-on guide that will help you get your container apps up and running smoothly on Azure!