How to Host Private Container Registries with Azure Container Registry and Virtual Networks

You can keep your private container registries safe with Azure. Use Azure Container Registry Premium and connect it to Virtual Networks to ensure your network remains private and secure. With private container registries, you control access through private endpoints and DNS settings.

Key security benefits include:

• Only your private network can access the registries, blocking the public internet.

• Firewall rules and private endpoints help protect your private container registries.

• Azure Active Directory provides enhanced sign-in options.

• Disabling public access strengthens security against attackers.

To set this up, create a virtual network, then configure Azure Container Registry. Next, add a private endpoint, set up DNS, and finally apply firewall rules to secure your private container registries.

Key Takeaways

• Use Azure Container Registry Premium with private endpoints. This keeps your container registries safe. Only your private network can get to them.

• Make a virtual network and a subnet. This keeps your container workloads apart from others. Connect them to your private registry with private endpoints. Set up DNS to help them find each other.

• Turn off public network access. Add firewall rules to block the internet. Only trusted networks can reach your registry.

• Use managed identities and role-based access control. This helps you manage permissions safely. You can automate image pulls without showing passwords.

• Test your setup often. Check DNS resolution and network connections. This makes sure your private container registry works well and stays safe.

Prerequisites

Azure Resources

You need some Azure resources before you begin. These resources help keep your container registry safe and private. Follow these steps to get your Azure ready:

1. Create or use an Azure Virtual Network (VNet).
   This network keeps your resources safe from others.

2. Add a subnet to your VNet.
   Use this subnet just for container instances. Make sure it is set up for Azure Container Instances.

3. Deploy container groups into the subnet.
   Put your container groups, like Azure Container Instances, in the subnet. Give each group a private IP address.

4. Set up Azure Container Registry (ACR) with VNet integration and firewall rules.
   This makes sure only things inside your VNet can use the registry.

5. Use configuration files or CLI commands for deployment.
   You can use YAML files, ARM templates, or Azure CLI. These tools help you deploy and connect your resources to the subnet.

Tip:
When you use VNet integration and firewall rules, you stop public internet access. Only trusted things in your VNet, like AKS clusters or CI/CD pipelines, can use your private registry.

Permissions and Tools

You need the right permissions and tools to manage your Azure Container Registry and private endpoints. The table below shows the main permissions you need:

You can use the Azure Portal, Azure CLI, Azure PowerShell, or ARM templates for these jobs. Make sure your account has the right roles before you start.

Setup Steps

Virtual Network

First, make an Azure Virtual Network. This network is the base for your private container registries. You need a VNet and at least one subnet for your containers.

• Make a VNet in your Azure account. Pick an address space that works for you.

• Add a subnet just for your container workloads, like Azure Kubernetes Service or Azure Container Instances.

• Your subnet must let traffic go out to Azure DNS IP (168.63.129.16). This keeps DNS working for your resources.

• Open port 443 in your network security group rules. This port is needed for safe talks with Azure services.

• You do not need extra network security group rules for Azure Container Registry if you use private endpoints.

Tip:
Private endpoints keep your registry traffic on the Azure backbone. This setup blocks the public internet and keeps your data safe.

ACR Deployment

Set up Azure Container Registry with the Premium SKU. The Premium tier gives you more security and lets you use private endpoints.

1. Go to the Azure Portal and make a new Azure Container Registry.

2. Pick the Premium SKU. This lets you use private endpoints and other security tools.

3. In the Networking tab, turn off public network access. This makes sure only private connections can reach your registry.

4. Finish making your registry.

You can also use Azure CLI to turn off public network access:

az acr update --name <registry_name> --resource-group <resource_group_name> --public-network-enabled false --default-action Deny

The Premium SKU lets you use customer-managed keys and special data endpoints for better security.

Private Endpoint

After you set up your registry, make a private endpoint. This connects your registry to your VNet with a private IP.

1. In the Azure Portal, open your container registry and go to Networking.

2. Add a new private endpoint. Use the same subscription, resource group, and region as your VNet.

3. Set the target sub-resource to 'registry'.

4. Pick your VNet and the subnet you made before.

5. Turn on Private DNS integration. This helps your resources find the registry name using the private IP.

6. Check your settings and make the private endpoint.

Private endpoints make sure only things in your VNet or peered VNets can use your private container registries. This keeps your traffic private and safe.

DNS Configuration

DNS setup is important for private endpoint connections. You must make sure your registry’s name points to its private IP inside your VNet.

1. Make a private DNS zone called privatelink.azurecr.io.

2. Link this DNS zone to your VNet.

3. When you make the private endpoint, Azure adds a DNS record for your registry in this zone.

4. If you use custom DNS servers, send queries you cannot answer to Azure’s DNS IP (168.63.129.16). This keeps name lookups working.

5. Make sure your network security group or firewall does not block this DNS IP.

With this setup, your containers can pull images from your registry using the private IP.

Firewall Rules

Firewall rules help keep your private container registries safe from outside networks.

• Let your registry’s REST API and storage endpoint use port 443.

• Use the registry’s full domain name, like <registry-name>.azurecr.io, in your rules.

• Allow access to Azure Blob Storage endpoints, like *.blob.core.windows.net, for storing data.

• Use Azure service tags like AzureContainerRegistry and AzureStorage to make your rules easier.

• If you use special data endpoints, allow access to endpoints like <registry-name>.<region>.data.azurecr.io.

• For geo-replicated registries, add all replica regions to your firewall rules.

• Turn on Private Link to keep all traffic inside your VNet.

Note:
Only allowed VNets and peered VNets can use your private container registries when you use private endpoints and firewall rules. This setup keeps your registry safe from the public internet.

Securing Private Container Registries

Network Isolation

You can keep your private container registries safe with network isolation. This means your registry is not open to the public internet. Only trusted networks can connect to it. When you use private endpoints, your registry gets a private IP address in your virtual network. Only things inside your virtual network or peered networks can reach the registry.

Private endpoints keep your data on the Azure backbone. This helps protect your images and metadata from outside dangers.

To make network isolation strong, follow these tips:

1. Connect your container workloads, like Azure Kubernetes Service or Azure Container Instances, to your virtual network. This lets you control and separate network traffic.

2. Use private endpoints for your registry. This keeps your registry hidden from the public internet.

3. Plan your subnets well. Do not make too many subnets for each app. Too many subnets can use up your IP addresses fast.

4. Set firewall rules to allow only trusted networks or IP addresses.

5. Use network policies to control how containers talk to each other and to outside resources.

6. Use role-based access control (RBAC) to limit who can manage or use your registry.

7. Give managed identities to your container instances. This lets them use other Azure resources safely.

8. Encrypt important data when it is stored and when it moves.

9. Store secrets in Azure Key Vault, not inside your containers.

10. Turn on logging and monitoring to watch network and security events.

11. Update your container images and registry software often to fix security problems.

When you use private endpoints and firewall rules together, you get layered security. Private endpoints let only your network reach the registry. Firewall rules let you pick which IP addresses or networks can connect. If you block all public access, only your trusted networks can use your private container registries.

Disabling Public Access

Turning off public network access is very important for keeping your private container registries safe. When you turn off public access, people on the internet cannot reach your registry. This lowers the chance of data leaks and keeps your images safe from attackers.

• Turning off public access means only your private networks can reach the registry.

• You lower the risk from threats on the open internet.

• You can turn on other security features, like stopping exports, to keep your data inside Azure.

• Using private endpoints with public access turned off gives you the best protection.

You can set public network access to "Disabled" in the Azure Portal or with the Azure CLI. Make sure you have private endpoints set up first. This way, your workloads can still pull images from your registry without needing the public internet.

Tip: Always check your firewall rules after turning off public access. Make sure only trusted networks and services can connect.

By doing these steps, you help keep your private container registries safe. Only trusted users and workloads can get to them.

Integration with Workloads

AKS and App Service

You can connect AKS and Azure App Service to private container registries. This helps keep your image pulls safe. When you make an AKS cluster, use the Azure CLI and add --attach-acr. This gives the AKS managed identity the AcrPull role. Now your pods can pull images without extra secrets. If you already have an AKS cluster, you can run this command:

az aks update --name <aks-cluster> --resource-group <resource-group> --attach-acr <acr-name>

This command links your cluster to the registry. It also sets the right permissions. For Azure App Service, give it a managed identity. Then give that identity the AcrPull role on your registry. Make sure your App Service and the registry’s private endpoint are in the same virtual network. Check your private DNS zone for the right records. This helps the App Service find the registry. Use the public registry name in your image URL. The private DNS will point it to the private IP.

Tip: Always check if your App Service plan supports VNet integration and pulling container images.

CI/CD Agents

To let your CI/CD agents reach private container registries, use self-hosted agents in your virtual network. Azure DevOps managed agents cannot use private endpoints. Put your self-hosted agent in the same network as your registry. You can use Azure Container Instances for a serverless choice. Make sure the registry’s firewall allows the agent’s IP or subnet. If your agents need to reach Azure DevOps services, set up a NAT Gateway for outbound access.

1. Put a self-hosted agent in your VNet.

2. Turn off public access on your registry.

3. Use private endpoints to keep traffic safe.

4. Set up a NAT Gateway if your agent needs to reach outside services.

Managed Identities

Managed identities help you connect to private container registries without saving secrets. Give your resource, like a VM or App Service, a managed identity. Give this identity the AcrPull role on your registry. On your VM, you can log in with:

az login --identity
az acr login --name <registryName>

Now you can pull images without typing a password. This keeps your credentials safe and makes automation easier. You can also use managed identities with ACR Tasks for safe image builds and pushes.

Note: Managed identities work with both system-assigned and user-assigned types. Always check that the right roles are set for safe access.

Validation and Troubleshooting

DNS Checks

You need to make sure your DNS setup works for your private container registry. Start by checking that your private DNS servers are at the top of your DNS resolver list. This helps your system find private domain names before it tries public DNS servers. You can use a single DNS resolver to forward requests to private DNS zones and cache answers for better speed and security.

Follow these steps to verify DNS resolution:

1. Go to your Container Registry in the Azure portal. Check the Networking settings. Make sure Public network access is off and a private endpoint exists.

2. Use a tool like nslookup to see if your registry’s name points to a private link domain, such as <registry>.privatelink.azurecr.io.

3. Confirm that your virtual network links to the private DNS zone. You can do this in the Azure portal or with Azure CLI.

4. If you use a custom DNS server, set it to forward DNS requests to Azure’s DNS service at 168.63.129.16.

5. Check that your DNS resolver order puts private DNS servers first.

Tip: Use tools like dig, nslookup, or resolvectl to test DNS resolution from your container app or a jumpbox.

Connectivity Tests

After DNS checks, test your network connection to the registry. You can use tools like ping, nc (netcat), tcpping, curl, or wget to check if you can reach the registry over port 443. For a quick health check, run:

az acr check-health --name <registry_name>

This command checks DNS, network access, and registry health. It gives you details about any problems. You can also use az acr check-health --name <registry_name> --vnet <vnet_name> to test from inside a virtual network.

Note: If you have trouble, check your firewall and proxy settings. Make sure your registry’s firewall allows traffic from your network.

Common Issues

You might face some common issues when setting up private endpoints and firewall rules:

• Private endpoints and firewall rules only work with the Premium SKU. If you use Basic or Standard, upgrade your registry.

• If you misconfigure firewall rules, you might allow unwanted access from the internet. Always set publicNetworkAccess to Disabled or defaultAction to Deny.

• DNS problems often cause image pull failures. Make sure your DNS points to the private endpoint and your virtual network links to the private DNS zone.

• If image pulls fail, check if your app or agent is in the right VNet or subnet. Test DNS resolution and network access from the app’s environment.

• For web apps, enable "Container image pull" and "Pull image over VNet" in the Deployment Center.

If you still have issues, try troubleshooting from another VM or container in the same subnet. This helps you find if the problem is with the network or the registry itself.

Advanced Scenarios

Geo-Replication

Geo-replication lets your Azure Container Registry work in many places. This feature helps your container images stay close to where you need them. When you turn on geo-replication, Azure copies your images to other regions. This setup gives you some good things:

• Your clusters pull images from the closest region, so it is faster.

• You save money because images do not travel far.

• If one region stops working, you can still get images from another.

• You only need to manage one registry and use the same image URL.

• Geo-replication with zone redundancy keeps your registry running if a datacenter fails.

Example: If you have AKS clusters in different places, you push your image once. Each cluster gets the image from its own local copy.

Hub-Spoke Topology

A hub-spoke network design helps you control who can use your registry. In this setup, your main services are in the hub. Other networks, called spokes, connect to the hub. Here are some important steps:

• Use Private Link for ACR and other services like Azure Key Vault.

• Put private endpoints in a subnet inside the spoke VNet. This keeps traffic close and lets you use network security group rules.

• You can also put private endpoints in the hub VNet if that works better.

• This setup keeps your registry off the public internet and helps you manage security in one place.

• Set network security at the subnet level for more control.

This way matches best practices for AKS and helps keep your resources safe.

Automation Tools

You can use automation to do many jobs in Azure Container Registry. Automation saves time and helps you make fewer mistakes. Here are some tools and features you can try:

• Use ACR Tasks to build, test, and deploy images by themselves.

• Set tasks to run at certain times or when you change your code.

• Make multi-step tasks for harder jobs.

• Run quick tasks without needing Docker on your computer.

• Use Azure CLI commands like az acr task create and az acr build to manage tasks.

• Set up webhooks to start builds from GitHub or Azure DevOps.

• Use service principals and personal access tokens to keep automation safe.

Automation tools help you keep your registry current and make your deployments faster and safer.

---

You can keep private container registries safe by following some steps. First, make a virtual network. Then, set up Azure Container Registry with private endpoints. This keeps your data inside Azure’s private network. It does not go out to the public internet. Private endpoints and network isolation help make things safer. They also make it easier to manage your setup.

When you use Azure Private Link, you get better security. You can also save money and make your network simpler. It helps you follow rules and control traffic with network security groups.

Remember to use ACR Tasks to build images automatically. Keep your registry updated and use strong access controls. For more features, try geo-replication, image scanning, and working with Azure Kubernetes Service. You can learn more from Microsoft Learn and the official documentation.

FAQ

How do you restrict access to your Azure Container Registry?

You use private endpoints and turn off public network access. Only things in your virtual network or peered networks can get to your registry. You set up firewall rules and use Azure role-based access control to manage who can use it.

Can you use Azure Container Registry with on-premises networks?

Yes, you can do this. You connect your on-premises network to Azure with VPN or ExpressRoute. After that, you set up private endpoints and DNS forwarding. This lets your on-premises resources pull images in a safe way.

What happens if you forget to configure DNS for your private endpoint?

Your workloads will not find the registry’s private IP. This means image pulls will not work. Always check your DNS settings and make sure your virtual network links to the private DNS zone.

Do you need the Premium SKU for private endpoints?

Yes, you need the Premium SKU. Only the Premium SKU lets you use private endpoints and advanced networking. You must upgrade your registry to use these security features.

How do you check if your registry uses the private endpoint?

You do a DNS lookup for your registry name from inside your virtual network. The answer should show a private IP and a domain like <registry>.privatelink.azurecr.io.