Examkin

Question

Difficulty: HardManage Container Images in Azure Container Registry

You are setting up a secure continuous integration (CI) pipeline to build and publish container images to an Azure Container Registry (ACR) named `acr2026`.

The pipeline must authenticate using an Azure Active Directory service principal named `sp-pipeline`. The service principal has just been created and has no permissions assigned.

You need to configure permissions, authenticate the pipeline runner, build a local image, and upload the image.

In which order should you perform the steps? To answer, arrange the actions in the correct sequence.

  1. 1Assign the AcrPush role to the service principal for the acr2026 registry resource.
  2. 2Run docker login acr2026.azurecr.io using the service principal Application ID as the username and the client secret as the password.
  3. 3Run docker build -t myapp:v1 . on the local runner to create the container image.
  4. 4Run docker tag myapp:v1 acr2026.azurecr.io/myapp:v1 to prepare the image for the registry.
  5. 5Run docker push acr2026.azurecr.io/myapp:v1 to upload the image to the registry.

Answer

The correct sequence of steps requires you to first assign the AcrPush role to the service principal. Next, log in to the registry using the docker login command with the service principal credentials and the registry's login server name (acr2026.azurecr.io). After authenticating, build the image locally with the docker build command, tag the image with the registry's namespace using the docker tag command, and finally push the tagged image to the registry with the docker push command.
To push an image to Azure Container Registry using a service principal, you must first authorize the principal with the AcrPush role. Next, authenticate Docker using the service principal's application ID and client secret against the registry login server. Then, build the image locally, tag it with the target registry's login server namespace, and finally push it.

Step-by-Step Solution

1
Assign the AcrPush role to the service principal.
The service principal is authorized to push images to the registry.
By default, a new service principal has no access. Pushing images requires the AcrPush role.
2
Run docker login targeting the registry's login server with the service principal credentials.
The Docker client on the runner is authenticated to the registry.
Docker CLI commands like docker push require authentication to the registry's specific login server.
3
Run docker build to build the image locally.
A local container image is created.
The image must exist locally before it can be tagged or pushed.
4
Run docker tag to apply the registry namespace to the image.
The image is tagged with the fully qualified registry login server path.
Docker uses the image tag prefix to determine the target registry domain during a push operation.
5
Run docker push with the fully qualified tag.
The image is uploaded and stored in the Azure Container Registry.
This is the final action that uploads the local image layers to the authenticated registry endpoint.

Key Concept

Building and pushing container images to Azure Container Registry using service principal authentication and Docker CLI.
Rate this question

Topics

Manage Container Images in Azure Container Registry

More questions from this topic