Domain 3 of 5 · Chapter 3 of 4

Containers

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Azure Administrator premium course — no separate purchase.

Included in this chapter:

  • Three container services and how they fit together
  • Azure Container Registry: SKUs and authentication
  • Azure Container Instances: container groups, sizing, restart policy
  • Container Apps: revisions, ingress, KEDA scaling

Choosing among ACI, Container Apps, and AKS

DimensionAzure Container InstancesAzure Container AppsAzure Kubernetes Service
Best forOne-off / batch tasks, sidecar groupsAutoscaling HTTP & event-driven microservicesFull Kubernetes control & ecosystem
AutoscalingNone. Fixed group sizeKEDA: HTTP, TCP, event, CPU/memoryCluster + pod autoscalers (you manage)
Scale to zeroNo (start/stop the group)Yes, except CPU/memory rulesNo (nodes always running)
Ingress / revisionsPublic IP + FQDN per group, no revisionsBuilt-in external/internal ingress, revisions, traffic splitYou configure (Ingress controller, etc.)
Management altitudeServerless, per-second billingManaged serverless (Kubernetes hidden)You operate the cluster

Decision tree

Need full Kubernetes control?YesAzure KubernetesService (AKS)NoMust instance count track load(autoscale on traffic or events)?YesAzure Container AppsKEDA autoscale, ingress, revisionsNoAzure Container Instancesfixed-size task, per-second billingScale to zero needed?Container Apps: yes for HTTP/TCP/event rules, no for CPU/memory rulesAlways: store images in Azure Container Registry (ACR)
Cheat sheet

Cheat sheet

  • ACR stores images; ACI and Container Apps run them
  • ACR Premium unlocks geo-replication, private link, content trust, and CMK
  • Use Premium ACR geo-replication to serve one registry from many regions
  • ACR SKU changes are in-place with no downtime
  • Authenticate to ACR with a Microsoft Entra identity, not the admin account
  • The ACR admin account is off by default and has two passwords
  • An ACI container group shares host, network, and storage like a pod
  • ACI multi-container groups are Linux-only
  • An ACI container group needs at least 1 vCPU and 1 GB of memory
  • ACI restart policy Always is the default; use OnFailure or Never for finite jobs
  • ACI bills per second and does not autoscale
  • An ACI container group's public IP can change on restart
  • An ACI image can't exceed 15 GB
  • Container Apps creates an immutable revision on every change
  • Container Apps ingress is external or internal, over HTTP or TCP
  • Container Apps autoscales with KEDA between min and max replicas
  • Container Apps scales to zero, but not on a CPU or memory rule
  • Container Apps scales out, not up: no vertical scaling
  • Choose ACI for fixed tasks, Container Apps for autoscaling services
  • An AKS Spot node pool must be a secondary user node pool, never the default
  • An AKS node pool's VM size and availability zones are fixed at creation: recreate to change them
  • A subnet hosting an ACI container group must be delegated to Microsoft.ContainerInstance/containerGroups
  • An ACI container group in a VNet needs a NAT gateway for outbound internet, and gets no public IP

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Introduction to private Docker container registries in Azure
  2. Serverless containers in Azure - Azure Container Instances overview
  3. Azure Container Apps overview
  4. Azure Container Registry SKU features and limits
  5. Azure Container Registry authentication options
  6. Using Azure Container Registry webhooks
  7. Introduction to container groups in Azure Container Instances
  8. Resource and quota limits for Azure Container Instances
  9. Restart policy for run-once tasks in Azure Container Instances
  10. Revisions in Azure Container Apps
  11. Ingress in Azure Container Apps
  12. Scaling in Azure Container Apps