Develop Containerized Solutions on Azure · Topic 1 of 2
Azure Container Registry, ACR Tasks and App Service
AI-200 container hosting: building, tagging and storing images in Azure Container Registry, ACR Tasks, and running containers on Azure App Service.
- 4 min
- Digest references never change; tags can be moved by a new push.
- Use unique tags for deployments; stable tags for base images.
- ACR Tasks build in Azure: quick tasks, triggered tasks, multi-step tasks.
What it is
Azure Container Registry (ACR) is a private registry for container images. ACR Tasks build images in Azure, so you do not need Docker on your own machine or build agent. Azure App Service can run a container image from ACR as a web app, with app settings supplied to the container as environment variables.
How it works
Images, tags and digests
| Reference | Example | Can change? |
|---|---|---|
| Stable tag | myreg.azurecr.io/api:1.0 | Yes, a new push moves the tag |
| Unique tag | myreg.azurecr.io/api:build-4521 | Only if someone pushes the same tag again |
| Digest | myreg.azurecr.io/api@sha256:... | No, it identifies the exact content |
Microsoft recommends stable tags for base images and unique tags for deployments, so every release is traceable and instances do not drift when a tag is re-pushed. A tag can also be locked against changes.
Registry tiers
ACR has Basic, Standard and Premium tiers. Premium adds features such as geo-replication and private endpoints, plus higher throughput and storage.
ACR Tasks
| Task type | What it does |
|---|---|
Quick task (az acr build) | Builds an image from a Dockerfile in Azure and pushes it to the registry |
| Triggered task | Rebuilds automatically on a source code commit, a base image update or a timer |
| Multi-step task | Runs a YAML-defined sequence of build, push and cmd steps, where a cmd step runs a container (for example to test the new image); run it with az acr run or save it as a task |
Base image update triggers keep application images patched when the base image they depend on is updated.
Running containers on App Service
- Create a web app with a container image source and point it at the ACR image.
- App Service pulls the image using a managed identity with the AcrPull role on the registry (with the
acrUseManagedIdentityCredssite setting turned on, plusacrUserManagedIdentityIDfor a user-assigned identity), or using registry credentials. - App settings are passed to the container as environment variables.
- Secrets can be supplied as Key Vault references in app settings, so the value stays in Key Vault and the app's managed identity reads it.
- App Service assumes the container listens on port 80. If it listens on another port, set the
WEBSITES_PORTapp setting. - Continuous deployment can restart the app when a new image is pushed to the tag.
A worked example: a Python API is built by an ACR quick task on each commit, tagged with the pipeline run ID, and deployed to App Service. The web app's managed identity has AcrPull on the registry and reads the database password through a Key Vault reference.
"Build the image without Docker installed on the build agent" points to an ACR quick task or ACR Tasks.
How the exam asks about this
- "Rebuild app images automatically when the base image is patched." An ACR task with a base image update trigger.
- "The web app must pull from ACR without stored credentials." Managed identity with AcrPull.
- "Supply a secret to a container without putting it in app settings as plain text." A Key Vault reference.
What to remember for the exam
- Digest references never change; tags can be moved by a new push.
- Use unique tags for deployments; stable tags for base images.
- ACR Tasks build in Azure: quick tasks, triggered tasks, multi-step tasks.
- App Service passes app settings to containers as environment variables.
- Pull from ACR with a managed identity that has AcrPull.
Deploying the latest tag makes releases untraceable and lets scaled-out instances run different builds.
Common mistakes
Deploying stable or latest tags to production. Use unique tags.
Storing registry passwords in app settings. Use a managed identity.
Forgetting the container port. App Service must route to the port the app listens on.
Check yourself
Which image reference always points to exactly the same content?
A digest reference, such as image@sha256 followed by the manifest digest.
How can App Service pull from ACR without credentials?
Give the web app a managed identity with the AcrPull role on the registry.
What does an ACR quick task do?
It builds an image from a Dockerfile in Azure and pushes it to the registry.
Topic 1 of 2 in Develop Containerized Solutions on Azure
Test yourself on Develop Containerized Solutions on Azure
The full Microsoft AI-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.