Automating ACR Image Updates from Docker Hub
Short answer
A Include Azure Container Registry (ACR) Tasks to automatically rebuild the custom image when the base image is updated.
Question
• Builds a custom container image by using a base image stored in a public Docker Hub repository
• Stores the custom container image in Azure Container Registry
• Deploys the custom container image to Azure Container Apps
The pipeline is triggered by commits to the Azure Repos repository.
You need to ensure that when the base image in Docker Hub is updated, the custom image in Azure Container Registry is updated automatically. The solution must minimize administrative effort.
What should you include in the solution?
Key Takeaways
The core concept is automating CI/CD triggers for dependency updates; the common trap is over-engineering with general-purpose automation tools like Azure Automation or Functions instead of using native registry features.
This question explores how to minimize administrative effort when updating custom container images based on upstream base image changes. The correct approach leverages Azure Container Registry (ACR) Tasks for automated trigger-based builds.
Common mistake: Candidates often select 'an Azure DevOps pipeline task' because they are familiar with the existing pipeline, but managing external webhooks and polling logic manually increases administrative overhead significantly compared to native ACR capabilities.
Expert Analysis
Why the Answer Is Correct
Azure Container Registry (ACR) Tasks provides a built-in feature called 'Image Trigger' or 'Base Image Update'. This allows you to configure ACR to automatically build an image whenever the underlying base image in a public repository (like Docker Hub) is updated. Since the scenario requires minimizing administrative effort and handling external triggers without maintaining complex webhook receivers, ACR Tasks is the ideal, managed solution.
Why the Other Options Are Wrong
An Azure Automation runbook or an Azure Function would require writing custom code to poll Docker Hub or listen to webhooks, which contradicts the 'minimize administrative effort' requirement. An Azure DevOps pipeline task can be triggered by commits, but it does not natively support triggering solely on external base image updates without additional infrastructure setup, making it more labor-intensive than ACR's native automation.
Community Comment Notes
Community consensus strongly supports ACR Tasks as the standard method for this specific pattern. As one user noted, this follows the 'OS & Framework Patching Pattern' where native automation hooks are preferred over custom scripts to handle security patches efficiently.
Exam Strategy
Always look for managed services that offer out-of-the-box automation for cloud-native patterns before considering general-purpose compute or automation resources. For container lifecycle management, check ACR features first.
Frequently Asked Questions
Why not use Azure DevOps pipelines for this?
Can ACR Tasks pull from private registries?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
gpais 👍 1 Answered A• The OS & Framework Patching Pattern: The scenario requires a mechanism to automatically rebuild an application container image whenever its upstream base image (hosted in a public repository like Docker Hub) gets updated with newer OS layers or security patches. • Why ACR Tasks is Correct: Azure Container Registry (ACR) Tasks features a native, out-of-the-box automation hook specifically called a base image update trigger. • Once you execute an initial container build using a Dockerfile that references a public base image tag (e.g., FROM node:alpine), ACR Tasks automatically maps out and tracks that dependency link. • ACR periodically monitors the public registry (checking Docker Hub or Microsoft Container Registry at regular background intervals). When it detects that the public tag has been updated, it automatically fires a cloud-native rebuild task without needing any custom code, fully satisfying the requirement to minimize administrative effort.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →