Azure Container Registry (ACR) — Complete Guide for .NET Lead
Azure Container Registry (ACR) is Microsoft's private Docker container registry that stores, manages, secures, and distributes container images for applications running on Azure Kubernetes Service (AKS), Azure App Service, Azure Container Apps, Azure Functions, Virtual Machines, and other container platforms.
Official Documentation
Azure Container Registry Documentation
Table of Contents
What is Azure Container Registry?
Why Do We Need ACR?
Docker Hub vs Azure Container Registry
ACR Architecture
Real-Time Enterprise Example
Image Lifecycle
Authentication
Azure DevOps Integration
AKS Integration
C# & Docker Example
Geo-Replication
Image Security
Best Practices
Lead-Level Interview Questions
1. What is Azure Container Registry?
Azure Container Registry is a fully managed private container image registry where you store Docker and OCI-compatible container images.
Instead of storing images on a public registry like Docker Hub, organizations use ACR to:
Store private images
Control access
Integrate with Azure services
Secure enterprise deployments
Improve deployment performance
2. Why Do We Need ACR?
Suppose your application contains:
Order Service
Payment Service
Inventory Service
Notification Service
Each service is packaged into a Docker image.
These images must be stored somewhere.
Developer
|
Docker Build
|
Azure Container Registry
|
AKS / App Service / Container Apps
ACR becomes the central image repository.
3. Docker Hub vs Azure Container Registry
| Docker Hub | Azure Container Registry |
|---|---|
| Public/Private | Private Enterprise Registry |
| Internet Hosted | Azure Integrated |
| Basic Security | Microsoft Entra ID & RBAC |
| Limited Enterprise Integration | Native Azure Integration |
| Community Images | Enterprise Images |
4. Real-Time Architecture
Developer
|
Git Push
|
Azure DevOps
|
Build Docker Image
|
Push Image
|
Azure Container Registry
|
+------------+-------------+
| | |
AKS App Service Container Apps
5. Real-Time Banking Example
Internet Banking
↓
Azure DevOps
↓
Docker Build
↓
Azure Container Registry
↓
AKS Cluster
↓
Customers
Every new application version is packaged as a Docker image and stored in ACR.
6. Repository Structure
Example:
mycompany.azurecr.io
|
+-- order-api
+-- payment-api
+-- inventory-api
+-- notification-api
Each repository contains multiple image versions.
7. Image Tagging
Examples:
order-api:1.0
order-api:1.1
order-api:2.0
order-api:latest
Avoid relying on the latest tag for production deployments. Use immutable version tags.
8. Docker Build
Dockerfile:
FROM mcr.microsoft.com/dotnet/aspnet:9.0
WORKDIR /app
COPY . .
ENTRYPOINT ["dotnet","OrderApi.dll"]
Build:
docker build -t order-api:1.0 .
9. Login to ACR
az acr login --name myregistry
10. Tag Image
docker tag order-api:1.0 myregistry.azurecr.io/order-api:1.0
11. Push Image
docker push myregistry.azurecr.io/order-api:1.0
Image flow:
Developer
↓
Docker Image
↓
Azure Container Registry
↓
Ready for Deployment
12. Pull Image
docker pull myregistry.azurecr.io/order-api:1.0
13. Azure DevOps Integration
Git Push
↓
Azure Pipeline
↓
Build
↓
Docker Build
↓
Push to ACR
↓
Deploy to AKS
Typical pipeline steps:
Restore
Build
Test
Docker Build
Push Image
Deploy
14. AKS Integration
Azure Container Registry
↓
AKS
↓
Pods
↓
Containers
AKS pulls the required image from ACR during deployment.
15. Authentication
Supported authentication methods include:
Microsoft Entra ID
Managed Identity
Service Principal
Repository Tokens (supported scenarios)
Admin Account (generally avoid in production)
Preferred approach:
AKS
↓
Managed Identity
↓
Azure Container Registry
↓
Access Granted
16. Geo-Replication
Large organizations deploy globally.
East US
↓
Azure Container Registry
↓
West Europe
↓
Southeast Asia
Geo-replication reduces latency and improves availability for Premium registries.
17. Image Security
ACR supports image security capabilities including:
Microsoft Entra authentication
Azure RBAC
Private Endpoints
Content trust/workflow integrations (where applicable)
Image scanning integrations through Microsoft Defender for Cloud and partner tools
18. C# Microservice Example
ASP.NET Core API
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();
var app = builder.Build();
app.MapControllers();
app.Run();
Containerize it with Docker and push the resulting image to ACR for deployment.
19. Enterprise Deployment Flow
Developer
|
Git
|
Azure DevOps
|
Build
|
Unit Tests
|
Docker Build
|
Azure Container Registry
|
AKS
|
Application Insights
20. Best Practices
Use immutable image tags.
Enable Microsoft Entra authentication.
Use Managed Identity where possible.
Apply Azure RBAC with least privilege.
Enable geo-replication for global deployments.
Keep base images updated.
Scan images for vulnerabilities.
Remove unused images with retention policies.
Integrate ACR with CI/CD pipelines.
21. Lead-Level Interview Questions
Basic
What is Azure Container Registry?
Why do we use ACR?
What is a Docker image?
What is a repository?
What is image tagging?
Intermediate
Docker Hub vs ACR?
How does AKS pull images?
How do you authenticate to ACR?
What is geo-replication?
How do you secure ACR?
How do you integrate ACR with Azure DevOps?
How do you manage image versions?
Lead-Level
Design a secure container deployment architecture.
How would you implement CI/CD using ACR?
How do you prevent deploying vulnerable images?
How would you design a multi-region container registry?
How would you optimize image pull performance?
How do you implement disaster recovery for container images?
How would you manage thousands of container images?
When would you choose ACR over Docker Hub?
22. Lead-Level Interview Answer
Interviewer: "How have you used Azure Container Registry in your project?"
Answer:
"In our .NET microservices platform, every ASP.NET Core service was containerized using Docker. Azure DevOps pipelines built versioned Docker images after successful builds and unit tests, then pushed those images to Azure Container Registry. AKS deployments referenced immutable image tags from ACR, ensuring consistent releases across DEV, QA, and Production. We secured the registry using Microsoft Entra ID, Azure RBAC, and Managed Identity, enabled geo-replication for global deployments, and integrated image vulnerability scanning into our CI/CD process. This provided secure, repeatable, and reliable container deployments for all microservices."
This is the type of comprehensive answer expected from a .NET Lead or Solution Architect, because it covers architecture, DevOps, security, scalability, and operational best practices.
