microsoft / microsoft/aspire

AddContainer + PublishAsAzureContainerApp does not configure ACR identity for image pull

Open
#16,011 7 comments 0 reactions 0 assignees View on GitHub
area-deployment silent-failure
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 12h
Merged PRs (30d)
201

Description

### Describe the bug

When using `AddContainer("name", "image").PublishAsAzureContainerApp(...)`, the generated Bicep does not include ACR registry credentials or user-assigned managed identity for image pull. The container image is hardcoded as a static string instead of being parameterized. This means the container app cannot pull images from ACR using identity-based auth, unlike `AddProject` which gets this automatically.

The root cause is in `ContainerAppContext.BuildContainerApp()` — ACR parameters are only allocated when `TryGetContainerImageName` returns `false`, but containers always have a `ContainerImageAnnotation`, so it always returns `true`.

### Expected Behavior

When `PublishAsAzureContainerApp` is used on a container resource, the generated Bicep should include parameterized image, ACR registry credentials, and managed identity — matching the behavior of project resources.

### Steps To Reproduce

```csharp
var builder = DistributedApplication.CreateBuilder(args);
builder.AddAzureContainerAppEnvironment("env");

builder.AddContainer("myapp", "myimage:latest")
.PublishAsAzureContainerApp((infra, app) => { });

builder.Build().Run();
```

Inspect the generated Bicep — no `registries` block, no user-assigned identity, image is literal `"myimage:latest"`.

### Anything else?

Our use case is deploying images from legacy projects that push directly to ACR outside of Aspire. We use `AddContainer` to reference those images and `PublishAsAzureContainerApp` to deploy them as container apps, but the generated Bicep lacks the identity-based ACR pull configuration needed to actually pull those images.

Affected code paths:
- `BaseContainerAppContext.TryGetContainerImageName` (`BaseContainerAppContext.cs:89`)
- `ContainerAppContext.BuildContainerApp` (`ContainerAppContext.cs:33`)
- `AddContainerRegistryManagedIdentity` (`BaseContainerAppContext.cs:487`)
- `AddContainerRegistryParameters` (`BaseContainerAppContext.cs:501`)

Contributor guide

Open the contributing guide

Research direction

Start in BaseContainerAppContext.cs at TryGetContainerImageName, AddContainerRegistryManagedIdentity, and AddContainerRegistryParameters, then trace their use from ContainerAppContext.cs in BuildContainerApp. Compare the AddContainer path with the project-resource path and inspect the generated Bicep for the reproduction. Done means the container app has a parameterized image, ACR registry credentials, and user-assigned managed identity for image pulls.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.