Containers in Azure

What it is

A container packages an application and what it needs, so that it runs the same way anywhere. Azure has three services you must tell apart. Azure Container Registry stores images. Azure Container Instances runs a container quickly with no cluster. Azure Container Apps runs containers as a serverless service with automatic scaling.

How it works

Azure Container Registry

Azure Container Registry (ACR) is a private registry for container images.

Geo-replication, which keeps copies of a registry in several regions, needs the Premium tier.

az acr create --resource-group rg-app --name contosoregistry --sku Standard
az acr login --name contosoregistry
docker push contosoregistry.azurecr.io/web:v1

Access is best given through Microsoft Entra roles, such as AcrPull to run images and AcrPush to push them, assigned to a user or a managed identity. An admin account also exists. It is turned off by default and is not meant for production. ACR Tasks can build images in Azure, for example when code changes.

Azure Container Instances

Azure Container Instances (ACI) runs containers without managing servers or a cluster. Containers run in a container group, which shares a host, a network and a lifecycle, much like a pod.

• You choose the CPU and memory for the group when you create it. ACI does not autoscale. To get more capacity you create more groups.
• A group can have a public IP address and a DNS name label.
• Linux and Windows containers are supported, and you can mount an Azure Files share.

The restart policy controls what happens when a container stops.

az container create --resource-group rg-app --name web --image contosoregistry.azurecr.io/web:v1 --cpu 1 --memory 1.5 --ports 80 --dns-name-label contoso-web

Azure Container Apps

Azure Container Apps runs containers on a managed platform that is built on Kubernetes, without you managing Kubernetes. Apps live in an environment that shares networking and logging.

• Ingress controls who can reach the app. External ingress is reachable from the internet. Internal ingress, limited to the environment, is reachable only by other apps in the environment.
• A revision is an immutable snapshot of an app version. You can run several revisions and split traffic between them.
• Scaling uses rules, based on HTTP traffic, CPU, memory or events such as queue messages. By default an app has a minimum of 0 and a maximum of 10 replicas.

An HTTP scale rule, or an event rule, can scale an app down to zero replicas, and you are not billed while it is at zero. CPU and memory rules cannot scale to zero.

Choosing a container service

More on Container Registry

Azure Container Registry Tasks can build images in Azure, for example whenever code is committed, so that you do not need a build server. A registry is private by default. To let a service pull images, give its managed identity the AcrPull role. Use the admin account only for quick tests.

More on Container Instances

Containers in a group share a network, so they reach each other on localhost. A group can mount an Azure Files share for storage that outlives the containers. Because the CPU and memory are fixed per group, a busy workload is served by creating more groups, not by autoscale.

Container Apps revisions and traffic

Every change to the app definition can create a new revision. You can run two revisions at once and split traffic between them, for example 90 percent to the current revision and 10 percent to a new one. This is a safe way to test a release, and you can send all traffic back to the earlier revision if there is a problem.

How the exam asks about this

• "Scale to zero when idle." Container Apps with an HTTP or event rule.
• "A back end reachable only from other apps in the environment." Internal ingress.
• "Pull images without a password." A managed identity with AcrPull.
• "Replicate a registry across regions." Premium tier geo-replication.
• "Restart only on failure." The OnFailure restart policy.