azure-container-registry-cli

Use az acr build with your registry name and image tag, for example az acr build --registry myregistry --image app:v1 . The build runs in Azure and pushes directly to the registry, so no local Docker daemon is required.

Run az aks update with --attach-acr to grant the kubelet identity the AcrPull role. For ABAC-enabled registries, manually assign the Container Registry Repository Reader role to the kubelet identity instead, since AcrPull is not accepted there.

No, the admin account should stay disabled in production because it grants full push and pull access without per-user auditing. Use Microsoft Entra RBAC roles, managed identities, or repository-scoped tokens for authentication instead.

Run acr purge as an ACR Task with filters and an age threshold, always starting with --dry-run to preview deletions. You can schedule it as a nightly task, but note that --untagged ignores the age filter and deletes all untagged manifests.

Geo-replication, private endpoints, IP network rules, dedicated data endpoints, connected registries, and retention policies all require the Premium SKU. Repository-scoped tokens work on all tiers, and zone redundancy is automatic in supported regions.

Since June 2025, allowing trusted services alone is insufficient for tasks using system-assigned managed identities. Enable the networkRuleBypassAllowedForTasks property, or run tasks on a VNet-attached agent pool to avoid the bypass entirely.