Azure Container Registry - Microsoft's Private Docker Registry

Azure Container Registry is Microsoft's private Docker registry. Think Docker Hub, but it costs money and doesn't go down randomly. If you're already on Azure and tired of hitting Docker Hub's rate limits, ACR might save your sanity.

The Three Tiers (And When to Use Them)

ACR has three tiers that'll confuse you at first:

Basic ($5/month) gets you 10GB storage and handles 1,000 pulls per minute. Perfect for side projects and learning. I used this for 6 months before hitting the storage limit.

Standard ($20/month) bumps you to 100GB and 3,000 pulls/minute. This is where most production apps land. The pricing jump hurts but the performance difference is real.

Premium ($30+/month) gives you 500GB, 10,000 pulls/minute, and fancy features like geo-replication. Only worth it if you're deploying globally or have strict compliance requirements.

Storage beyond the included amounts costs $0.10/GB per month - that adds up fast with large images.

Why ACR Actually Works (Most of the Time)

The only reason to use ACR is if you're already balls-deep in Azure. Your AKS clusters can pull images without credential juggling thanks to managed identity. It just works, which is rare enough in the container world to matter.

ACR Tasks builds your images in the cloud, triggered by Git commits or base image updates. Costs $0.000167 per CPU-second, which sounds cheap until you're building massive Node.js projects with 500MB node_modules folders. I've seen builds that cost $2 each.

The vulnerability scanning found 200+ issues in our production images. Turns out using node:latest was a terrible idea. The scanner integrates with Microsoft Defender and actually provides useful remediation steps.

Authentication: Where Things Get Complicated

Authentication works fine if you're all-Azure. For everything else, it's a nightmare:

• az acr login --name myregistry works until it doesn't
• Service principals expire and break your CI/CD
• Non-Azure systems need token juggling that'll make you question your life choices

I spent 3 hours debugging why our Jenkins couldn't push images. The answer? The service principal credentials expired. ACR gives you zero warning about this - just a useless "authentication failed" error message. This Stack Overflow thread covers the most common auth issues you'll hit.

For non-Azure CI/CD systems, check the Azure/acr GitHub repo for troubleshooting tips and known issues. The community there has documented most of the edge cases you'll encounter.

What You'll Actually Use ACR For

• Private base images: Custom Ubuntu/Alpine images with your company's tooling
• Microservice storage: Dozens of small services that change constantly
• ML model artifacts: Storing trained models alongside your inference containers
• Helm charts: OCI artifact support means you can store Helm charts too

The geo-replication feature saved us when East US went down for 6 hours. Images pulled from West US automatically. But it doubles your storage costs, so budget accordingly.

If you're coming from Docker Hub, the official migration guide walks through importing existing images. The Docker Hub rate limiting changes in 2020 drove a lot of teams to ACR - and for good reason.

Private Endpoints and Network Security

Private endpoints keep your registry traffic off the public internet, which sounds great until you realize it makes troubleshooting network issues a complete nightmare. You can have up to 200 private endpoints per registry - way more than you'll ever need unless you're building some kind of container registry empire.

Setting up private endpoints took me 2 days and involved wrestling with DNS, subnets, and NSG rules. The end result? Our Jenkins server couldn't reach the registry because of a misconfigured route table. Private endpoints are secure, but they add complexity that'll bite you during outages.

Customer-managed keys let you control your encryption keys through Key Vault. This is mostly compliance theater unless you're in a regulated industry. The setup is straightforward, but remember that if you lose access to your keys, your registry becomes a very expensive paperweight.

Geo-Replication: Double the Cost, Double the Resilience

Geo-replication is ACR's killer feature. Your images get replicated to multiple regions automatically, and pulls come from the nearest location. We cut our deployment time from 8 minutes to 3 minutes in our Singapore office after enabling replication to Southeast Asia.

The catch? It doubles your storage costs. That 100GB Standard registry becomes a $40/month bill with one replica region. Budget accordingly, or your CFO will have questions about why your "simple container storage" costs more than your database cluster.

Geo-replication saved us during the East US outage in March. Our production deployments kept working because images pulled from West US automatically. The failover wasn't completely seamless - we had about 30 seconds of slower pulls - but way better than a complete outage.

ACR Tasks: Cloud Builds That Actually Work

ACR Tasks builds your Docker images in Azure without needing local Docker. Costs $0.000167 per CPU-second, which sounds cheap until you're building a Next.js app that takes 15 minutes and uses 4 CPUs. That's $0.60 per build, or $18/month if you build once per day.

The multi-step tasks are genuinely useful. We have one that:

1. Builds the app
2. Runs tests
3. Scans for vulnerabilities
4. Pushes to staging
5. Runs integration tests
6. Promotes to production registry

When it works, it's the only thing that doesn't completely suck. When it breaks, debugging is hell because you can't easily reproduce the build environment locally. The ACR Tasks documentation has examples, but this GitHub discussion is more helpful for troubleshooting build failures.

Automated patching through base image monitoring is genuinely clever. When Ubuntu releases security updates, ACR automatically rebuilds your images. We went from manually tracking base image updates to having fresh images within 2 hours of upstream patches.

Performance: Fast Enough to Matter

Premium tier gives you 10,000 pulls per minute, which sounds like overkill until you have 50 services restarting simultaneously after a cluster upgrade. We hit the Standard tier limit (3,000/minute) during a botched deployment and watched our rollback take 20 minutes instead of the usual 5.

Image layer caching and deduplication work well. Our microservices share common base layers, so only the changed application layer gets pulled. This cut our typical deployment from 200MB downloads to 50MB.

The performance optimization guide is actually worth reading. Multi-stage builds and proper layer ordering can cut your image sizes in half. Our Node.js images went from 800MB to 300MB just by moving the npm install step after copying package.json but before copying source code. Pro tip: ACR Tasks breaks randomly on Node 18.17.1, use 18.16.x for builds.

Azure Integration: The Real Selling Point

AKS integration with managed identity just works. No service principals to manage, no credential rotation, no authentication headaches. Your AKS cluster can pull from ACR automatically.

The integration with Azure Container Apps is smooth too. Push a new image, and it gets deployed automatically. We use this for staging environments where we want every commit to deploy immediately.

App Service can pull from ACR, but the container startup time is awful compared to dedicated container platforms. Fine for low-traffic internal tools, terrible for anything customer-facing.

Windows containers are a 4GB nightmare that make you question your life choices. The image sizes are massive (4GB+ base images), pulls are slow, and you'll run into weird networking issues that don't exist with Linux containers. Stick with Linux unless you absolutely must run .NET Framework apps.

For cost optimization, check out the Azure pricing calculator to model your actual usage. The monitoring and alerting guide helps track storage growth before it becomes a budget problem. This comparison analysis covers ACR vs ECR vs Docker Hub from a cost perspective.