Sections

9. Glossary and Cheatsheet

8 min read

The 10-second lookup.

Glossary

AcrDelete — Azure RBAC data-plane role permitting deletion of repositories, manifests, and tags.

AcrPull — Azure RBAC data-plane role permitting image pull. What every runtime identity needs; Reader is not a substitute.

AcrPush — Azure RBAC data-plane role permitting push (and pull). What a build pipeline needs, and all it should have.

Admin user — a built-in shared account with two rotatable passwords and full push/pull, disabled by default. Unattributable in logs and readable by anyone with Contributor. Keep it off.

Anonymous pull — registry-wide unauthenticated read. Standard and Premium only; there is no per-repository setting.

ACR Tasks — managed builds inside Azure: quick tasks (az acr build), commit- and schedule-triggered tasks, base-image-update triggers, and multi-step YAML tasks.

Cache rule — pull-through caching from an upstream registry (Docker Hub, MCR, GHCR, Quay), with a credential set for authenticated upstreams. The clean answer to Docker Hub rate limits. ⚠️ Verify tier availability.

Connected registry — a synchronised nested registry deployed on-premises or at the edge. Premium only.

Content trust — ACR's Notary v1 / Docker Content Trust image signing. On a retirement path ⚠️ verify the current date; use Notation (Notary v2) with Key Vault keys for new work.

Control plane — ARM at management.azure.com, governing the registry resource. Owner, Contributor, Reader.

Credential set — Key Vault–backed credentials used by a cache rule to authenticate to an upstream registry.

Customer-managed key (CMK) — encryption at rest with a Key Vault key instead of a Microsoft-managed one. Premium; generally must be configured at registry creation ⚠️ verify.

Data endpoint (dedicated) — <registry>.<region>.data.azurecr.io, a per-region allow-listable hostname for layer-blob traffic. Premium. Without it, layer downloads redirect to shared Microsoft-managed storage hostnames that a firewall can't target precisely.

Data plane — <name>.azurecr.io, the OCI Distribution API, governing images. AcrPull, AcrPush, AcrDelete.

Digest — sha256:…, the content address of a manifest or blob. The only unambiguous name for an image. Deploy by digest.

Export policy — blocks az acr import/export out of a registry, for exfiltration control. Requires public network access disabled; also blocks your own promotion path.

Geo-replication — Premium feature giving one registry regional replicas behind a single login server, with Traffic Manager routing. Asynchronous and eventually consistent.

Layer — a compressed filesystem-diff blob, deduplicated registry-wide by digest.

Login server — the DNS name <name>.azurecr.io. Globally unique across all of Azure.

Manifest — the OCI JSON document naming an image's config blob and ordered layers. Its SHA-256 is the image's identity.

Manifest list / image index — a manifest of manifests, resolving one digest to per-architecture images (linux/amd64, linux/arm64).

Notation — the Notary v2 CLI for signing OCI artifacts; the successor to content trust. Pairs with Ratify for verification at Kubernetes admission.

OCI artifact — anything stored using the OCI manifest format: images, Helm charts, SBOMs, signatures, WASM modules, arbitrary blobs pushed with ORAS.

ORAS — "OCI Registry As Storage"; the CLI for pushing and pulling non-image artifacts.

Private endpoint — a VNet NIC for the registry. Sub-resource name registry; private DNS zone privatelink.azurecr.io.

Quarantine policy — newly pushed images are unpullable until a scanner clears them ⚠️ verify current preview status.

Registry — the ARM resource Microsoft.ContainerRegistry/registries. Regional, globally-unique alphanumeric name (no hyphens), 5–50 characters.

Replication — a child resource representing one regional replica. Each bills as an additional registry.

Repository — a path string namespacing manifests within a registry. Not an ARM resource, so not an RBAC scope.

Retention policy — auto-deletes untagged manifests after N days. The single most valuable cost setting ⚠️ verify tier availability.

Scope map — a named list of repository-level permissions, e.g. repositories/team-a/api/content/read. Premium.

Soft delete — a policy retaining deleted artifacts (and reserving the registry name) for a window ⚠️ verify current preview/GA status. Not a backup.

Tag — a mutable pointer from a name to a manifest digest. Make them immutable.

Tag immutability — policy preventing an existing tag from being repointed. Turn it on.

Token — a credential bound to one scope map, with up to two passwords and an expiry. Premium. A password, not an identity.

Untagged manifest — a manifest no tag points at, produced every time a moving tag is repushed. Still stored, still billed.

Webhook — an HTTP POST on push/delete/chart events. Regional on a geo-replicated registry.

Zone redundancy — Premium setting spreading the registry (and each nominated replica) across availability zones within a region. Set at creation ⚠️ verify.

Cheatsheet

# --- create and inspect ---
az acr create -n myregistry -g rg-platform -l uksouth --sku Premium
az acr show   -n myregistry --query "{sku:sku.name, login:loginServer, public:publicNetworkAccess}" -o table
az acr update -n myregistry --sku Premium                    # tier change: online, seconds
az acr update -n myregistry --admin-enabled false            # keep it off
az acr update -n myregistry --public-network-enabled false   # ⚠️ needs a working private endpoint FIRST

# --- auth ---
az acr login -n myregistry                    # Entra token exchange, writes a short-lived Docker credential
az acr login -n myregistry --expose-token     # when there's no Docker daemon

# --- build without a local Docker daemon ---
az acr build -r myregistry -t api:$(git rev-parse --short HEAD) .

# --- browse content (data plane — needs AcrPull, not Reader) ---
az acr repository list       -n myregistry -o table
az acr repository show-tags  -n myregistry --repository api --orderby time_desc -o table
az acr repository show       -n myregistry --image api:v1.2 --query digest -o tsv
az acr manifest list-metadata -r myregistry -n api --query "[?tags==null].digest" -o tsv   # the orphans

# --- promote between registries, server-side, BY DIGEST ---
az acr import -n acrprod --source acrstg.azurecr.io/api@sha256:9f86d0... --image api:v1.2.0

# --- geo-replication ---
az acr replication create -r myregistry -l northeurope
az acr replication list   -r myregistry -o table

# --- policies that matter ---
az acr config retention update  -r myregistry --status enabled --days 14 --type UntaggedManifests
az acr config content-trust update -r myregistry --status disabled       # prefer Notation
az acr repository update -n myregistry --repository api --write-enabled false   # freeze a repository

# --- access ---
ACR_ID=$(az acr show -n myregistry -g rg-platform --query id -o tsv)
az role assignment create --assignee <principal-id> --role AcrPull --scope $ACR_ID
az aks update -n aks-prod -g rg-platform --attach-acr myregistry    # = AcrPull for the kubelet identity

# --- cleanup ---
az acr repository delete -n myregistry --image api:oldtag --yes
az group delete -n rg-acr-demo --yes --no-wait

Resource ID shape

/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{name}

# child resources
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{name}/replications/{region}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{name}/tasks/{task}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{name}/scopeMaps/{map}
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{name}/tokens/{token}

# NOT a resource ID — repositories are data, which is why there is no repository-level RBAC scope
myregistry.azurecr.io/team-a/api

That ID is what every role assignment scope, policy assignment, private endpoint connection, and error message is written against.

Image reference shapes

myregistry.azurecr.io/api:v1.2                  # tag — mutable pointer. For humans.
myregistry.azurecr.io/api@sha256:9f86d081884c…  # digest — immutable. For deployments.
myregistry.azurecr.io/team-a/nested/api:v1.2    # repositories may be nested paths
myregistry.<region>.data.azurecr.io             # dedicated data endpoint (Premium) — allow-list this

Limits worth memorising

Limit	Scope	Approximate value
Included storage	Per registry	Basic ~10 GiB · Standard ~100 GiB · Premium ~500 GiB ⚠️ verify
Read / write ops per minute	Per registry	Steps up by tier ⚠️ verify current figures
Download / upload bandwidth	Per registry	Steps up by tier ⚠️ verify
Webhooks	Per registry	~2 · ~10 · ~500 by tier ⚠️ verify
Registry name	Global	5–50 chars, alphanumeric only, globally unique
Registries per subscription per region	Per subscription-per-region	Quota, raisable via support ⚠️ verify
ACR Tasks concurrency	Per registry	Higher on Premium ⚠️ verify
Geo-replications	Per registry (Premium)	Limited by regions and budget

Every number above varies by region and subscription type and moves more often than the concepts do — check current Azure documentation before quoting one in a design review.

The five things to remember

A tag is a pointer; a digest is the thing. Deploy by digest.
Reader cannot pull. Data-plane roles are AcrPull / AcrPush / AcrDelete.
Premium is a feature tier, not a size tier. Private endpoints, geo-replication, CMK, scope maps, and zone redundancy are all Premium-only.
Untagged manifests are the cost leak. Enable the retention policy.
Disable the admin user. Contributor can read its password.

← Back to the Azure Container Registry overview · ← Previous: Interview Questions