What is Azure Container Registry?
Azure Container Registry (ACR) is a managed registry for storing and managing container images. The service supports Docker images, Helm charts, and other OCI artifacts. ACR integrates with Azure Kubernetes Service, Container Apps, and Azure DevOps for automated build pipelines.
Core Features
- Private registry with Microsoft Entra ID authentication and role-based access control
- Three tiers (Basic, Standard, Premium) with increasing storage allowance and throughput
- Geo-replication, private endpoints, and firewall rules in the Premium tier
- Optional vulnerability scanning via Microsoft Defender for Containers
- ACR Tasks for automated, cloud-based image builds
- Signed images based on the Notary Project as the successor to Docker Content Trust
Typical Use Cases
DevOps teams store application images for Kubernetes and Container Apps deployments. Multi-region applications use geo-replication (Premium tier) for faster image pulls across regions. Security teams scan images for known vulnerabilities before production deployment.
Benefits
- Native integration with AKS, Container Apps, and Azure DevOps
- Access control via Microsoft Entra ID and private endpoints
- Geo-replication for lower latency on global deployments (Premium tier)
- Automated builds via ACR Tasks without custom CI infrastructure
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Container Registry: CI/CD pipeline setup, security configuration including migration from Docker Content Trust to the Notary Project, and multi-registry strategies.
Frequently Asked Questions
What is the difference between Basic, Standard, and Premium tier?
Basic includes 10 GiB, Standard 100 GiB, and Premium 500 GiB of storage, with increasing throughput. Only Premium offers geo-replication, private endpoints, and advanced network controls such as firewall rules. The choice depends on storage needs, security requirements, and deployment regions.
How does vulnerability scanning work in ACR?
Microsoft Defender for Containers can scan images on push and at rest for vulnerabilities, showing results with severity rating and remediation guidance. This is a separate, paid add-on rather than a default feature of every tier.
Can I build images automatically in ACR?
Yes, ACR Tasks enables automated image builds directly in Azure, triggered by Git commits, base image updates, or a schedule, reducing the need for custom build infrastructure for container images.
How do I secure my container registry?
Use private endpoints for network isolation, Microsoft Entra ID with RBAC for access control, and managed identities for credential-less image pulls. For signed images, Microsoft now recommends the Notary Project standard, since Docker Content Trust in ACR is being phased out.
What is happening to Docker Content Trust in ACR?
Docker Content Trust is being deprecated in Azure Container Registry in stages: since late 2025 it can no longer be enabled on new registries, and full retirement is planned for 2028. Microsoft recommends moving to signatures based on the Notary Project.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
