EEdukron DevOps Library
ContainersIntermediate10 submodules

Azure Container Registry

Good answers cover repository versus image versus tag versus digest, identity choices, network isolation, RBAC, retention, tasks, replication, and supply-chain evidence.

Interview focus

Answer with mechanism, evidence, and trade-offs

Good answers cover repository versus image versus tag versus digest, identity choices, network isolation, RBAC, retention, tasks, replication, and supply-chain evidence.

Strong-answer signals

  • Create and secure ACR
  • Organize repositories, images, and tags
  • Authenticate pipelines and runtimes
  • Push and pull through service connections
  • Use ACR Tasks and geo-replication

Flow diagram

Azure Container Registry answer flow

Use this flow to structure design and scenario answers from context through evidence and recovery.

  1. 01
    Build imageAzure Container Registry stage 1: build image with an auditable result before the next stage begins.
  2. 02
    Authenticate identityAzure Container Registry stage 2: authenticate identity with an auditable result before the next stage begins.
  3. 03
    Push immutable tagAzure Container Registry stage 3: push immutable tag with an auditable result before the next stage begins.
  4. 04
    Scan and retainAzure Container Registry stage 4: scan and retain with an auditable result before the next stage begins.
  5. 05
    Replicate if neededAzure Container Registry stage 5: replicate if needed with an auditable result before the next stage begins.
  6. 06
    Pull from runtimeAzure Container Registry stage 6: pull from runtime with an auditable result before the next stage begins.

Official Microsoft reference

Architecture diagrams from Microsoft documentation

Use these diagrams beside the original Edukron notes and flows to compare the learning model with the official product and architecture view.

Official Microsoft architecture for building and deploying AKS applications with Azure Pipelines, ACR, security, and observability.

Azure Pipelines CI/CD architecture for AKS

The architecture connects PR validation, CI, container registries, staged AKS deployment, promotion, security scanning, Key Vault, Azure Monitor, Prometheus, Grafana, and Log Analytics.

Practical interview scenario

Design, diagnose, and defend your decision

A global AKS platform pulls mutable latest tags from a public registry using an admin password. Move it to ACR with immutable versions, private access, identity-based pull, scanning, and regional resilience.

A complete response should include
  • Business impact and technical constraints
  • Architecture or execution sequence
  • Identity, security, and evidence
  • Failure handling and recovery
  • Metrics and next improvement

Module question spotlight

Five questions to practise first

Model answers included
01ACR creationWhat problem does ACR creation solve, how does it work in Azure Container Registry, and what is it commonly confused with?

Define the mechanism and ownership boundary first. Explain that it provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle, then contrast it with the adjacent responsibilities represented by the module prerequisites and the following Repositories concept. Close with a concrete validation signal.

02RepositoriesHow would you implement and validate Repositories for a production workload?

Start from workload constraints and existing state. State the requirement, configure the smallest working unit, connect its dependencies, test success and failure, and document operational ownership. Include identity, dependencies, normal and failure tests, monitoring, and an explicit recovery decision.

03ImagesA change involving Images causes a production symptom. What evidence would you inspect and how would you recover safely?

Establish scope and recent change, inspect the native configuration and event or log evidence, test the dependency boundary, apply the smallest reversible mitigation, verify user impact has recovered, and retain the findings for permanent prevention.

04TagsWhat problem does Tags solve, how does it work in Azure Container Registry, and what is it commonly confused with?

Define the mechanism and ownership boundary first. Explain that it provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle, then contrast it with the adjacent responsibilities represented by the preceding Images concept and the following Authentication concept. Close with a concrete validation signal.

05AuthenticationHow would you implement and validate Authentication for a production workload?

Start from workload constraints and existing state. Identify the actor, authentication method, permission scope, protected resource, expiry or rotation behavior, and audit event. Include identity, dependencies, normal and failure tests, monitoring, and an explicit recovery decision.

Complete question bank

30 topic-aware interview questions

10 submodules
01

ACR creation

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set
02

Repositories

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set
03

Images

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set
04

Tags

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set
08

ACR Tasks

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set
10

ACR security

Concept, implementation, and troubleshooting questions with model answers, evaluation points, follow-ups, and weak-answer warnings.

Open question set