Domain 1 of 4 · Chapter 3 of 7

Deploy containers to Azure App Service

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Developing AI Cloud Solutions on Azure premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • What App Service supplies around your image
  • Authenticate the image pull with a managed identity
  • Ports, pings, and the container start time limit
  • How configuration reaches the container
  • Key Vault references for secrets in app settings
  • Redeploy automatically on a registry push
  • Deployment slots and swaps for containers
  • Exam-pattern recognition

Three ways to put a new image in front of production traffic

ConsiderationUpdate the image reference directlyContinuous deployment webhookStaging slot and swap
What starts itYou run az webapp config container set with the new image or tagA docker push to the watched repository and tag posts to the webhookYou deploy to the staging slot, then issue the swap
Effect on the running appApp Service pulls the new image and serves the old one until the new one is readyThe webhook restarts the app, which then pulls the updated imageInstances are warmed in the source slot first, then routing switches
Validation before production trafficNone; the change goes straight to the live appNone; whatever was pushed to that tag is what startsFull, on the slot's own hostname, and swap with preview adds a pause
RollbackPoint the app back at the previous image and wait for another pullPush the previous image again, or turn continuous deployment offSwap the same two slots back for the last known good app
Tier requirementAny tier that runs custom containersAny tier that runs custom containersStandard, Premium, or Isolated
Container-specific catchA stable tag can pull different content on a later restart or scale-outNeeds basic authentication publishing credentials enabled or the webhook gets 401Auto swap is unsupported for containers, and managed identities do not swap

Decision tree

Must the release be validatedbefore it takes production traffic?yesnoStandard, Premium, orIsolated tier plan?Should a registry pushredeploy on its own?yesnoyesnoStaging slot, then swapwarmed instances, rollback = swap backScale up to Standard, orvalidate before the pushContinuous deploymentwebhookUpdate the image referenceaz webapp config container set

Cheat sheet

  • App Service pulls from ACR with a managed identity and AcrPull
  • WEBSITES_PORT tells App Service which container port to route to
  • Continuous deployment redeploys on a new image push
  • App settings surface as container environment variables
  • Connection strings are injected with type prefixes
  • az webapp config appsettings set merges named keys and restarts the app
  • Key Vault references resolve secrets at runtime
  • Key Vault references require an identity with Get permission
  • A versionless reference picks up rotated secrets
  • Slot swap gives zero-downtime releases
  • Deployment-slot settings stay with the slot on swap

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Configure an App Service app
  2. Environment variables and app settings reference
  3. Configure a custom container for Azure App Service
  4. Use Key Vault references as app settings in Azure App Service and Azure Functions
  5. Configure CI/CD to custom containers in Azure App Service
  6. Set up staging environments in Azure App Service