Lab: ACR and Container Apps revisions

Outcome

Create a private registry, push a tagged training image, grant the smallest pull permission, then deploy it to a Container App with ingress, two revisions, a traffic split, and a safe rollback.

Do

1. Create a disposable ACR. Build or import a harmless web image, tag it with an immutable training tag, push it, and list repositories/tags. Assign a test workload identity only the current pull role required by the selected ACR authentication method; do not enable broad admin access as a shortcut.
2. Create a Container Apps environment and app with HTTP ingress, explicit target port, bounded scale rule, and the registry image. Verify the FQDN and a successful response.
3. Set multiple-revision mode, deploy a second image tag that changes a visible response, and inspect both active revisions. Send 80/20 traffic only after the weights sum to 100%; record revision names and observed responses. Return 100% to the known-good revision as rollback.

Verify

Capture registry/repository/tag, pull authorization, ingress target port/FQDN, revision state, traffic weights, and rollback. You should now understand: ACR stores images; a workload needs explicit pull authorization; Container Apps ingress routes to revisions, and multiple-revision mode permits deliberate traffic splitting.

Break and fix

1. Deploy with a nonexistent image tag or remove the test pull role. Diagnose image-pull identity, registry server, repository/tag, and revision event; restore least privilege or correct the tag.
2. Configure a wrong target port. Diagnose listener/ingress mismatch, correct the port, and verify the revision becomes ready.
3. Try traffic weights that do not total 100. Correct the rule and verify the known-good revision receives the intended share.

Scenario practice

1. Configure: Specify image tagging, registry authorization, ingress, revision mode, scale bounds, and a 10% rollout plan.
2. Diagnose: A new revision cannot serve traffic. Inspect image pull, revision events, target port, readiness, and traffic assignment.
3. Distinguish: Contrast ACR with Docker Hub, ACI with Container Apps, a revision with an image tag, and traffic split with autoscaling.

Clean up

Return all traffic to the known-good revision, delete the Container App/environment, remove test role assignments, delete the repository/registry, and delete the disposable resource group.

Sources and re-audit

• ACR quickstart, checked 2026-08-22.
• Container Apps ingress, checked 2026-08-22.
• Container Apps traffic splitting, checked 2026-08-22.

Re-audit when registry roles, ingress, revisions, or traffic behavior changes.

Related

acr · azure-app-container-apps · managed-identity · All labs