acr

Azure Container Registry (ACR)

What it is

Azure Container Registry (ACR) is a managed private registry for container images (and related OCI artifacts). You store, build, and distribute your container images locally in Azure, controlling access with Entra authentication and built-in security features (georeplication, retention, network isolation).

Why it exists

Public registries (Docker Hub) are outside your security perimeter and have pull limits. ACR keeps your images private, close to your compute, authenticates with Microsoft Entra identity, and lets you build images in the cloud — the trusted source that ACI and AKS pull from.

Key ideas

• SKUs: Basic / Standard / Premium — Premium adds georeplication, private endpoints, and increased throughput.
• Many registries → many repos → many images/tags; tag images with versions so ACI and AKS can pull updates.
• Build inside ACR via ACR Tasks (acr build, acr task) so images don’t leave your network.
• Security: Entra role-based auth (AcrPull/AcrPush), anonymous pull off option, firewall/private-link on Premium.
• Integration: az container create --image <acr>/repo:tag (ACI) and az aks create --attach-acr / K8s imagePullSecrets (AKS) use it without exposing credentials.
• Georeplication replicates images across regions for low-latency pulls and resilience.

How it fits (diagram)

Exam notes

• ACR is the private image store feeding ACI and AKS; authentication is Entra-based (not shared secrets).
• Premium SKU required for georeplication and private endpoints.
• ACR Tasks build images in-region (acr build) — a common AZ-104/Docker workflow.
• AZ-104: connect ACR ↔ ACI (--acr) and ACR ↔ AKS (attached registry) for private pulls.

Related

Path MOC · aci · aks

📘 Source: Microsoft Learn — Acr