You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
Azure Container Registry (ACR) is a managed Docker registry that stores container images for Azure deployments. To authenticate without managing credentials, you can use a managed identity on an Azure resource such as a Linux virtual machine or an Azure Kubernetes Service (AKS) cluster. The identity can be user-assigned (created and managed separately) or system-assigned (tied to the resource’s lifecycle). The flow is: enable the identity on the resource, grant it a role like AcrPull on ACR, and then the resource uses that identity to pull images without storing any passwords.
You create a registry using the Azure CLI or Azure PowerShell. After creating the registry, you push a sample container image from a local Docker installation. Registry settings such as name, service tier, and public access are verified at creation time. The chosen tier (Basic, Standard, or Premium) determines storage limits, throughput, and whether advanced features like geo-replication are available.
Securing images means controlling who can pull or push to the registry. Managed identities are assigned roles with specific permissions, such as AcrPull for read-only access or AcrPush for write access. Azure Active Directory integrates as the authentication source, so no local admin accounts are needed. You should disable the built-in admin user account and rely on managed identities or service principals. Additional security policies can scan images for vulnerabilities before they are deployed.
Image management includes pulling from and pushing to the registry, tagging versions, and deleting outdated images. For registries on Azure Stack Edge devices, you must retrieve the endpoint details, download and install the device’s certificate, then sign in using Docker commands. The certificate establishes a trust boundary between the local tooling and the edge registry.
ACR offers three service tiers: Basic, Standard, and Premium. The Premium SKU is required for geo-replication, which synchronizes registry content across multiple Azure regions. When you choose a SKU, consider your throughput needs (number of concurrent pulls/pushes), storage capacity, and whether low-latency access in several regions is important. Geo-replication automatically ensures that a host in Europe pulls from a European replica, while a host in Asia pulls from an Asian replica, reducing network distance.
Administrators manage the lifecycle of container images through four operations: push (upload a new image), pull (download for deployment), tag (assign a version label), and delete (remove unused images). Proper tagging strategies, such as using semantic versioning or timestamps, enable rollback to a known-good version. Regularly deleting stale images reduces storage costs and keeps repository clutter low.
ACR supports service endpoints and private endpoints to restrict access to specific virtual networks. A private endpoint gives the registry a private IP address inside your VNet, so traffic never leaves the Microsoft backbone. Virtual network rules deny access from public IPs. Authentication is handled by managed identities (system-assigned or user-assigned), which let Azure resources like Azure Container Apps pull images without storing credentials. For the highest security, disable the admin user account.
ACR plugs into CI/CD pipelines and Azure services like Azure Kubernetes Service (AKS) and Azure App Service. You can set up continuous deployment: when an image is pushed, an automatic deployment updates the running application. ACR Tasks build and patch images in the cloud using the az acr build command, removing the need for a local Docker engine. Logs and diagnostics from the registry flow to Log Analytics, giving you metrics on push/pull activity and errors.
Geo-replication is a Premium-tier feature that manages a single registry across multiple Azure regions. The registry automatically replicates content to regional replicas, so container hosts pull from the nearest replica. This provides regional outage resilience (if one region fails, replicas in other regions remain available) and network-close access for globally distributed deployments. You manage one registry centrally, and replication uses Azure regional pairings to maintain data consistency during disaster recovery.
ACR Tasks automate image building, testing, and patching directly in the cloud. Using the az acr build command, developers can create images without a local Docker engine, streamlining the development pipeline. Tasks can trigger automatically on source code commits to a GitHub repository or when a base image (e.g., the OS layer) is updated. This ensures that images stay patched with the latest security fixes without manual intervention.
Webhooks and Azure Event Grid monitor registry events such as ImagePushed, ImageDeleted, or ChartPushed. When one of these events fires, it triggers an external workflow—for example, starting a CI/CD deployment when a new image version is pushed, or logging a deletion for auditing. This event-driven architecture keeps your container environment synchronized with the latest registry changes without polling.
To harden the registry further, disable public internet access and use Private Links, so only traffic from specific virtual networks reaches the registry. Attribute-Based Access Control (ABAC) provides fine-grained repository permissions based on image metadata or tags, ensuring a user or identity can only pull or push to specific repositories. The Domain Name Label (DNL) feature appends a unique hash to the registry’s DNS name, preventing subdomain takeover attacks. Managed identities with roles like AcrPull remain the recommended way to grant access without administrative credentials.
StudyCerts
StudyCerts