Containers: ACR, Container Apps & AKS

By the end of this lesson you will be able to build a container image in Azure Container Registry without Docker on your laptop, run it on Azure Container Apps with automatic scaling, pull images securely with a managed identity, and decide when you need Azure Kubernetes Service instead.

Containers in one paragraph

A container packages your app with everything it needs: the language runtime, libraries and settings. It runs the same on your laptop, a test server and Azure. A container image is the packaged template; a container is a running copy of it. If you are new to this, the Docker tutorial explains it in depth.

Think of a steel tiffin box with fixed compartments. Whatever kitchen packs it, the box fits every dabbawala's crate and every office desk the same way. Containers give software that same standard shape.

Where containers run on Azure

A good rule: start with Container Apps, and move to AKS only when you need something Container Apps cannot do.

Azure Container Registry

ACR is a private registry for container images, like a private Docker Hub. It has Basic, Standard and Premium tiers; Premium adds features such as geo-replication and private endpoints. Registry names are globally unique and use only letters and numbers.

Step 1: write a small Dockerfile for the Flask tiffin app from the App Service lesson.

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn
COPY app.py .
EXPOSE 8000
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

Step 2: create a registry and build the image in Azure with ACR Tasks. You do not need Docker installed locally: az acr build uploads your folder and builds it in the cloud.

az group create --name rg-containers --location centralindia --output none
az acr create --resource-group rg-containers --name acrtiffinpune01 --sku Basic --output none

az acr build --registry acrtiffinpune01 --image tiffin-api:v1 .

...
Run ID: ca1 was successful after 52s

The build log is long; this is its last line, traced from the ACR Tasks quickstart. Your run ID and time will differ.

Step 3: check the stored tags.

az acr repository show-tags --name acrtiffinpune01 --repository tiffin-api --output tsv

v1

Keep the registry's admin user disabled. Services should pull images with a managed identity that has the AcrPull role.

Azure Container Apps

Azure Container Apps runs containers on a managed, Kubernetes-based platform, but you never see Kubernetes. You get:

• Ingress: a public or internal HTTPS address for your app.
• Autoscaling with KEDA, an open-source event-driven autoscaler: scale on HTTP traffic, queue length or CPU, including scale to zero when idle.
• Revisions: each deployment creates an immutable revision, and you can split traffic between revisions for gradual releases.
• Jobs: containers that run to completion on demand or on a schedule.

Apps live in a Container Apps environment, a secure boundary that shares a virtual network and logging.

Step 1: create an environment and the app. The Container Apps commands come from the containerapp CLI extension, which the CLI installs when asked.

az containerapp env create --resource-group rg-containers --name cae-tiffin \
  --location centralindia --output none

az containerapp create --resource-group rg-containers --name ca-tiffin-api \
  --environment cae-tiffin --image acrtiffinpune01.azurecr.io/tiffin-api:v1 \
  --registry-server acrtiffinpune01.azurecr.io --registry-identity system \
  --target-port 8000 --ingress external --min-replicas 0 --max-replicas 5 \
  --query properties.configuration.ingress.fqdn --output tsv

ca-tiffin-api.kindsea-1a2b3c4d.centralindia.azurecontainerapps.io

--registry-identity system gives the app a system-assigned managed identity and grants it pull access to the registry, so no registry password is stored. The host name format is traced from the Container Apps docs; yours will have a different random part.

Step 2: open https://<fqdn>/ and you should see the menu JSON. The first request after idle time may take a few seconds while a replica starts, because --min-replicas 0 lets the app scale to zero.

Step 3: release v2 by building a new tag and updating the image:

az acr build --registry acrtiffinpune01 --image tiffin-api:v2 .
az containerapp update --resource-group rg-containers --name ca-tiffin-api \
  --image acrtiffinpune01.azurecr.io/tiffin-api:v2 --output none

Azure Kubernetes Service (AKS) overview

Kubernetes is an open-source system that runs and manages containers across a cluster of machines. AKS is Azure's managed Kubernetes: Azure runs the control plane (the "brain" of the cluster), and you run workloads on node pools, which are groups of VMs.

Choose AKS when you need the full Kubernetes API: custom controllers and operators, service meshes, special scheduling, GPU node pools, or a shared platform for many teams. The cost is real complexity: upgrades, networking choices, node security and capacity planning.

AKS offers Free, Standard and Premium cluster management tiers; Standard adds a financially backed uptime SLA for the control plane, and Premium adds long-term support for Kubernetes versions. Microsoft also offers AKS Automatic, a mode where Azure chooses and manages most cluster settings for production-ready defaults. A minimal cluster looks like this:

az aks create --resource-group rg-containers --name aks-tiffin --node-count 2 \
  --generate-ssh-keys --attach-acr acrtiffinpune01 --output none
az aks get-credentials --resource-group rg-containers --name aks-tiffin
kubectl get nodes

--attach-acr lets the cluster's identity pull from your registry. The Kubernetes tutorial teaches the kubectl side.

Common mistakes

• Using latest as the only tag. You cannot tell which code is running or roll back. Tag images with versions or Git commit IDs.
• Turning on the ACR admin user. It is a shared password. Use managed identities with AcrPull.
• Jumping to AKS for one web app. Container Apps or App Service does the job with far less work.
• Forgetting the target port. If the container listens on 8000, ingress must target 8000.

Key points

• ACR stores private images; az acr build builds them in Azure without local Docker.
• Container Apps runs containers with ingress, revisions, jobs and KEDA scaling, including scale to zero.
• Pull images with managed identities and the AcrPull role, never the admin user.
• AKS gives full managed Kubernetes for complex platforms, at the cost of more operations work.
• Start simple: Container Apps or App Service first, AKS when you truly need Kubernetes.

az containerapp create --resource-group rg-exam --name ca-exam-api \
  --environment cae-exam --image acrexamlko01.azurecr.io/exam-api:v3 \
  --registry-server acrexamlko01.azurecr.io --registry-identity system \
  --target-port 3000 --ingress external --min-replicas 1 --max-replicas 10 --output none