Automating ACR Image Updates from Docker Hub

Design solutions for logging and monitoring
Answer Correct answer: A — Include Azure Container Registry (ACR) Tasks to automatically rebuild the custom image when the base image is updated.

You have an Azure subscription that contains an Azure DevOps pipeline and an Azure Repos repository. The pipeline performs the following actions: • Builds a custom container image by using a base image stored in a public Docker Hub repository • Stores the custom container image in Azure Container Registry • Deploys the custom container image to Azure Container Apps The pipeline is triggered by commits to the Azure Repos repository. You need to ensure that when the base image in Docker Hub is updated, the custom image in Azure Container Registry is updated automatically. The solution must minimize administrative effort. What should you include in the solution?

  1. ACR Tasks Correct Answer
  2. an Azure Automation runbook
  3. an Azure function hosted in Container Apps
  4. an Azure DevOps pipeline task

Community Insight

The core concept is automating CI/CD triggers for dependency updates; the common trap is over-engineering with general-purpose automation tools like Azure Automation or Functions instead of using native registry features.

This question explores how to minimize administrative effort when updating custom container images based on upstream base image changes. The correct approach leverages Azure Container Registry (ACR) Tasks for automated trigger-based builds.

Candidates often select 'an Azure DevOps pipeline task' because they are familiar with the existing pipeline, but managing external webhooks and polling logic manually increases administrative overhead significantly compared to native ACR capabilities.

Community Discussion (1 comments)

gpais 👍 1 Selected: A
• The OS & Framework Patching Pattern: The scenario requires a mechanism to automatically rebuild an application container image whenever its upstream base image (hosted in a public repository like Docker Hub) gets updated with newer OS layers or security patches. • Why ACR Tasks is Correct: Azure Container Registry (ACR) Tasks features a native, out-of-the-box automation hook specifically called a base image update trigger. • Once you execute an initial container build using a Dockerfile that references a public base image tag (e.g., FROM node:alpine), ACR Tasks automatically maps out and tracks that dependency link. • ACR periodically monitors the public registry (checking Docker Hub or Microsoft Container Registry at regular background intervals). When it detects that the public tag has been updated, it automatically fires a cloud-native rebuild task without needing any custom code, fully satisfying the requirement to minimize administrative effort.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Azure Container Registry (ACR) Tasks provides a built-in feature called 'Image Trigger' or 'Base Image Update'. This allows you to configure ACR to automatically build an image whenever the underlying base image in a public repository (like Docker Hub) is updated. Since the scenario requires minimizing administrative effort and handling external triggers without maintaining complex webhook receivers, ACR Tasks is the ideal, managed solution.

Why the Other Options Are Wrong

An Azure Automation runbook or an Azure Function would require writing custom code to poll Docker Hub or listen to webhooks, which contradicts the 'minimize administrative effort' requirement. An Azure DevOps pipeline task can be triggered by commits, but it does not natively support triggering solely on external base image updates without additional infrastructure setup, making it more labor-intensive than ACR's native automation.

Community Comment Notes

Community consensus strongly supports ACR Tasks as the standard method for this specific pattern. As one user noted, this follows the 'OS & Framework Patching Pattern' where native automation hooks are preferred over custom scripts to handle security patches efficiently.

Exam Strategy

Always look for managed services that offer out-of-the-box automation for cloud-native patterns before considering general-purpose compute or automation resources. For container lifecycle management, check ACR features first.

Frequently Asked Questions

Why not use Azure DevOps pipelines for this?

DevOps pipelines are excellent for commit-triggered builds but require extra configuration to detect external base image changes, increasing admin effort compared to native ACR triggers.

Can ACR Tasks pull from private registries?

Yes, ACR Tasks supports pulling from private registries using service principals or managed identities, though this question specifies a public Docker Hub source.

More AZ-305 FAQ →

Related Analysis

HOTSPOT You are planning an Azure Storage solution for sensi

S-Grade

HOTSPOT You plan to deploy multiple containerized microservi

S-Grade

You plan to deploy an app that will use an Azure Storage acc

S-Grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide