Where should your private container images be stored for Azure hosting?
Why A is the answer
Azure Container Registry
ACR stores, versions and manages images, and hosting services pull from it.
In detail
- Azure Container Registry stores private images.
- Use managed identity to pull, not stored passwords.
Use case
An illustrative scenario, not a real incident.
A team pushes its private images to Azure Container Registry, and Azure services pull them with a managed identity.
See it in different ways
flowchart LR A["Source code"] --> B["ACR Tasks build"] B --> C["Azure Container Registry"] C --> D["App Service, Container Apps or AKS"]
mindmap
root((Container hosting))
Container Apps
Serverless
Scale to zero
Revisions
AKS
Full Kubernetes
Node pools
App Service
Simple web API
Deployment slots
Container Registry
Stores images
Build tasksflowchart LR S0["Build"] --> S1["Push to the registry"] --> S2["Pull at deployment"]
Key point: Private images belong in Azure Container Registry.
Why the other options are wrong
- B. A public file share that anyone can read
- A public share exposes your images.
- C. In a file share on a storage account
- A file share is not an image registry.
- D. Inside the Key Vault that holds the application's secrets
- Key Vault holds secrets.