AddContainer + PublishAsAzureContainerApp does not configure ACR identity for image pull
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 201
Description
### Describe the bug
When using `AddContainer("name", "image").PublishAsAzureContainerApp(...)`, the generated Bicep does not include ACR registry credentials or user-assigned managed identity for image pull. The container image is hardcoded as a static string instead of being parameterized. This means the container app cannot pull images from ACR using identity-based auth, unlike `AddProject` which gets this automatically.
The root cause is in `ContainerAppContext.BuildContainerApp()` — ACR parameters are only allocated when `TryGetContainerImageName` returns `false`, but containers always have a `ContainerImageAnnotation`, so it always returns `true`.
### Expected Behavior
When `PublishAsAzureContainerApp` is used on a container resource, the generated Bicep should include parameterized image, ACR registry credentials, and managed identity — matching the behavior of project resources.
### Steps To Reproduce
```csharp
var builder = DistributedApplication.CreateBuilder(args);
builder.AddAzureContainerAppEnvironment("env");
builder.AddContainer("myapp", "myimage:latest")
.PublishAsAzureContainerApp((infra, app) => { });
builder.Build().Run();
```
Inspect the generated Bicep — no `registries` block, no user-assigned identity, image is literal `"myimage:latest"`.
### Anything else?
Our use case is deploying images from legacy projects that push directly to ACR outside of Aspire. We use `AddContainer` to reference those images and `PublishAsAzureContainerApp` to deploy them as container apps, but the generated Bicep lacks the identity-based ACR pull configuration needed to actually pull those images.
Affected code paths:
- `BaseContainerAppContext.TryGetContainerImageName` (`BaseContainerAppContext.cs:89`)
- `ContainerAppContext.BuildContainerApp` (`ContainerAppContext.cs:33`)
- `AddContainerRegistryManagedIdentity` (`BaseContainerAppContext.cs:487`)
- `AddContainerRegistryParameters` (`BaseContainerAppContext.cs:501`)
Contributor guide
Research direction
Start in BaseContainerAppContext.cs at TryGetContainerImageName, AddContainerRegistryManagedIdentity, and AddContainerRegistryParameters, then trace their use from ContainerAppContext.cs in BuildContainerApp. Compare the AddContainer path with the project-resource path and inspect the generated Bicep for the reproduction. Done means the container app has a parameterized image, ACR registry credentials, and user-assigned managed identity for image pulls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100