1. Container Architecture for Architects

Containers package application code + dependencies into an immutable unit that runs identically everywhere. The architect's job: choose the right registry, runtime, and orchestration layer.

Key Concepts

• Image — Immutable artifact; a layered filesystem + run command. Tagged with version (e.g., myapp:1.4.2).
• Registry — Stores and distributes images. ACR is Azure's private OCI-compliant registry.
• Orchestration — Manages multiple container instances: scaling, healing, networking. AKS (full Kubernetes) or Container Apps (managed, simpler).
• Runtime — Executes containers. ACI is Azure's serverless runtime — no cluster to manage.

2. Azure Container Registry (ACR)

Tiers

Geo-Replication (Premium)

Replicate your registry to multiple Azure regions. Consumers pull from the nearest replica — lower latency, built-in HA. If one region is down, traffic routes to the next closest.

ACR Tasks — Automated Builds

ACR Tasks run container builds in the cloud — no local Docker daemon required. Three trigger types:

• Quick task — az acr build for one-off builds (like a cloud docker build).
• Automatically triggered — on source-code commit (GitHub/Azure Repos), base-image update, or scheduled timer.
• Multi-step task — YAML-defined pipeline: build → test → push multiple images.

Content Trust & Security (Premium)

• Content Trust (Docker Notary v2) — Cryptographically sign images; consumers verify signatures before pulling.
• Private endpoints — Registry accessible only via private IP over VNet; no public exposure.
• Customer-managed keys — Encrypt image layers at rest with your own keys in Key Vault.
• Quarantine pattern — Images land in quarantine; pass vulnerability scan → promoted to available.

3. Azure Container Instances (ACI)

ACI is serverless containers — deploy a container group in seconds with no cluster, no VM, no orchestrator. Pay per vCPU-second and GB-second.

When to Use ACI

• Quick batch jobs (data processing, report generation)
• CI/CD build agents (spin up, run pipeline, destroy)
• Sidecar containers for testing or support tasks
• Burst capacity from AKS via Virtual Kubelet
• Event-driven workloads that need fast cold start

Limitations — Know When NOT to Use ACI

• ❌ No built-in orchestration (no auto-scaling, no rolling deployments)
• ❌ No self-healing — if a container crashes, you must restart it externally
• ❌ Limited networking — no full VNet integration on all SKUs (Windows has constraints)
• ❌ Max 4 vCPUs / 16 GB RAM per container group (standard SKU); GPU SKUs available but limited
• ❌ No persistent storage by default — mount Azure Files for state
• ❌ Cold start can be 10-30s for large images

Container Groups

ACI's deployment unit is a container group — one or more containers that share the same lifecycle, network (localhost), and storage volumes. Analogous to a Kubernetes Pod.

4. ACI Architecture Patterns

Pattern 1: CI/CD Build Agents

Spin up an ACI container with your build tools, execute the pipeline, push artifacts, then delete the container. Zero idle cost.

Pattern 2: Batch Processing

Queue-driven: Azure Queue Storage triggers a Logic App or Function that spins up N ACI containers in parallel, each processing a chunk. Fan-out/fan-in without managing any infrastructure.

Pattern 3: Sidecar Containers

Deploy an app container + a logging/monitoring sidecar in the same container group. The sidecar ships logs to Log Analytics while the app focuses on business logic.

Pattern 4: Virtual Kubelet Burst from AKS

AKS installs the Virtual Kubelet (ACI connector). When the cluster runs out of node capacity, new pods burst to ACI — scaling to hundreds of instances in seconds without provisioning new VMs. Ideal for seasonal traffic spikes.

5. ACR + ACI + Managed Identity

Best practice: eliminate stored credentials entirely. Use managed identity for image pulls.

How It Works

1. Create a user-assigned managed identity.
2. Grant it AcrPull role on the ACR.
3. Assign that identity to the ACI container group at deployment time.
4. ACI uses the identity's token to authenticate to ACR — no passwords, no service principals to rotate.

# Create identity
az identity create -g myRG -n acr-pull-id

# Get identity resource ID & principal ID
IDENTITY_ID=$(az identity show -g myRG -n acr-pull-id --query id -o tsv)
PRINCIPAL_ID=$(az identity show -g myRG -n acr-pull-id --query principalId -o tsv)

# Grant AcrPull on the registry
ACR_ID=$(az acr show -n myregistry --query id -o tsv)
az role assignment create --assignee $PRINCIPAL_ID --role AcrPull --scope $ACR_ID

# Deploy ACI with managed identity
az container create \
  --resource-group myRG \
  --name myapp \
  --image myregistry.azurecr.io/myapp:latest \
  --assign-identity $IDENTITY_ID \
  --acr-identity $IDENTITY_ID

6. Container Apps vs ACI vs AKS — When Each Fits

7. Real-World: CI/CD Pipeline with ACR Tasks + ACI Ephemeral Agents

8. Knowledge Check