Azure Container Registry Best Practices for CI/CD

Azure Container Registry stores the images your pipelines build and your services pull. Poor registry hygiene — unbounded image growth, weak access control, no vulnerability scanning — creates security and cost problems that are painful to fix after the fact. This page covers the practices that keep your ACR clean, secure, and fast.

# Tag and push with multiple tags in CI
SHORT_SHA=$(git rev-parse --short=8 HEAD)
BUILD_ID=$(Build.BuildId)   # substitute your actual build ID variable
REGISTRY="myregistry.azurecr.io"
IMAGE="myapp/api"

# Login
az acr login --name myregistry

# Build with all three tag patterns
docker build \
  -t "${REGISTRY}/${IMAGE}:sha-${SHORT_SHA}" \
  -t "${REGISTRY}/${IMAGE}:build-${BUILD_ID}" \
  -t "${REGISTRY}/${IMAGE}:main" \
  .

# Push all tags
docker push "${REGISTRY}/${IMAGE}:sha-${SHORT_SHA}"
docker push "${REGISTRY}/${IMAGE}:build-${BUILD_ID}"
docker push "${REGISTRY}/${IMAGE}:main"

# Terraform — ACR with Premium tier for production CI/CD
resource "azurerm_container_registry" "main" {
  name                = "myappregistry"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  sku                 = "Premium"
  admin_enabled       = false    # never enable admin account in production

  # Enable geo-replication to West US 2
  georeplications {
    location                = "westus2"
    zone_redundancy_enabled = true
    tags                    = {}
  }

  # Enable content trust for signed images
  trust_policy {
    enabled = true
  }

  # Require HTTPS
  network_rule_set {
    default_action = "Deny"
    ip_rule {
      action   = "Allow"
      ip_range = "0.0.0.0/0"   # tighten this to your pipeline agent IP ranges
    }
  }

  tags = {
    environment = "production"
    managed_by  = "terraform"
  }
}

# Grant the pipeline Service Principal push access
resource "azurerm_role_assignment" "pipeline_push" {
  scope                = azurerm_container_registry.main.id
  role_definition_name = "AcrPush"
  principal_id         = var.pipeline_sp_object_id
}

# Grant AKS cluster pull access
resource "azurerm_role_assignment" "aks_pull" {
  scope                = azurerm_container_registry.main.id
  role_definition_name = "AcrPull"
  principal_id         = azurerm_kubernetes_cluster.main.kubelet_identity[0].object_id
}

# Enable retention policy for untagged manifests (Premium tier only)
# Untagged manifests older than 7 days are automatically deleted
az acr config retention update \
  --name myregistry \
  --status enabled \
  --days 7 \
  --type UntaggedManifests

# Show current retention policy
az acr config retention show --name myregistry

# Manually purge tagged images using acr purge (run via ACR Tasks)
# This deletes images tagged with pattern "build-*" older than 30 days
az acr run \
  --registry myregistry \
  --cmd "acr purge --filter 'myapp/api:build-.*' --ago 30d --keep 5 --untagged" \
  /dev/null

# Schedule the purge to run daily at 2 AM UTC using an ACR Task
az acr task create \
  --registry myregistry \
  --name cleanup-old-builds \
  --schedule "0 2 * * *" \
  --cmd "acr purge --filter 'myapp/api:build-.*' --ago 30d --keep 10 --untagged" \
  --context /dev/null

# Enable Defender for Containers on the subscription (covers all ACR instances)
az security pricing create \
  --name Containers \
  --tier Standard

# In a pipeline: scan with Trivy and fail the build on HIGH/CRITICAL CVEs
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy:latest image \
  --exit-code 1 \
  --severity HIGH,CRITICAL \
  --format table \
  "myregistry.azurecr.io/myapp/api:sha-${SHORT_SHA}"

# Generate a SARIF report for Azure Security Center integration
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd)/results:/results \
  aquasec/trivy:latest image \
  --format sarif \
  --output /results/trivy-results.sarif \
  "myregistry.azurecr.io/myapp/api:sha-${SHORT_SHA}"

# Publish Trivy SARIF results to Azure Pipelines security tab
- task: PublishBuildArtifacts@1
  displayName: 'Publish Trivy SARIF results'
  inputs:
    pathToPublish: '$(System.DefaultWorkingDirectory)/results'
    artifactName: 'security-scan-results'

# Create a webhook that fires when any image is pushed
az acr webhook create \
  --registry myregistry \
  --name deploy-on-push \
  --uri "https://myfunctionapp.azurewebsites.net/api/deploy-trigger?code=xxx" \
  --actions push \
  --scope "myapp/api:main"

# Test the webhook manually
az acr webhook ping \
  --registry myregistry \
  --name deploy-on-push

# List recent webhook deliveries and their status
az acr webhook list-events \
  --registry myregistry \
  --name deploy-on-push

# Terraform — ACR with private endpoint
resource "azurerm_private_endpoint" "acr" {
  name                = "acr-private-endpoint"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "acr-privateserviceconnection"
    private_connection_resource_id = azurerm_container_registry.main.id
    subresource_names              = ["registry"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "acr-dns-zone-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.acr.id]
  }
}

resource "azurerm_private_dns_zone" "acr" {
  name                = "privatelink.azurecr.io"
  resource_group_name = azurerm_resource_group.main.name
}

Last verified: 19 March 2026 · Cloud services change frequently. Verify details against official documentation before making infrastructure decisions.