Securing and Distributing Windows Server Container Images

Manage Windows Server Container Images

Evaluate Base Image Options

When building Windows Server containers, the base image is the foundation everything else sits on. A base image provides the operating system, runtime, and basic tools that your application needs to run. Microsoft hosts base images in the Microsoft Container Registry (MCR), and these images come in different versions for different programming languages.

When choosing a base image, avoid tags that specify exact minor versions like "8.0" because those tags never receive updates. Instead, use tags that point to the latest stable version so you automatically get security patches. For example, use the .NET isolated worker model image at mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated8.0, the Java image at mcr.microsoft.com/azure-functions/java:4-java21, and the Python image at mcr.microsoft.com/azure-functions/python:4-python3.12. If your image ends with -appservice, you can enable SSH and remote debugging features. Always pull the latest base images regularly to stay protected.

Implement Security Best Practices

Keeping container images secure requires ongoing attention because new vulnerabilities are discovered constantly. The most important rule is to avoid outdated minor versions in your base images—these stop receiving updates and become security risks. When vulnerabilities are found in the base image, your custom image inherits that risk until you rebuild it.

Rebuild your custom container images regularly using the latest base image updates to incorporate new features and critical security patches. Implement vulnerability scanning to automatically detect known weaknesses in your images, and enable content trust to verify that images come from their stated source and have not been tampered with. Keep your custom image layers optimized by removing unnecessary tools and files, because each layer adds potential attack surface that attackers could exploit.

Utilize Azure Container Registry

Azure Container Registry (ACR) is Microsoft's service for storing and managing container images in Azure. ACR handles the complete lifecycle of your container images, from development through deployment.

ACR provides image replication policies that automatically copy your images to multiple Azure regions, which improves availability and reduces latency for users in different geographical areas. The service also manages image tagging, giving you a systematic way to label and organize different versions of your containers so you can track what is deployed and roll back when needed. Setting up continuous deployment in Azure App Service connects ACR with your code repository, so when you push new code, the system automatically builds a new container image and deploys it without manual intervention. This CI/CD integration works with sources like Docker Hub or GitHub Actions, creating a smooth pipeline from commit to running container.