Use ACR production SKU#
Reliability · Container Registry · Rule · 2020_06 · Important
ACR should use the Premium or Standard SKU for production deployments.
Description#
Azure Container Registry (ACR) provides a range of different service tiers (also known as SKUs). These service tiers provide different levels of performance and features.
Three service tiers are available: Basic, Standard, and Premium. Basic container registries are only recommended for non-production deployments. Use a minimum of Standard for production container registries.
The Premium SKU provides higher image throughput and included storage, and is required for:
- Geo-replication
- Availability zones
- Private Endpoints
- Firewall restrictions
- Tokens and scope-maps
Recommendation#
Consider using the Premium Container Registry SKU for production deployments.
Examples#
Configure with Azure template#
To deploy registries that pass this rule:
- Set the
sku.name
property toPremium
orStandard
.
For example:
{
"type": "Microsoft.ContainerRegistry/registries",
"apiVersion": "2023-01-01-preview",
"name": "[parameters('registryName')]",
"location": "[parameters('location')]",
"sku": {
"name": "Premium"
},
"identity": {
"type": "SystemAssigned"
},
"properties": {
"adminUserEnabled": false,
"policies": {
"quarantinePolicy": {
"status": "enabled"
},
"trustPolicy": {
"status": "enabled",
"type": "Notary"
},
"retentionPolicy": {
"days": 30,
"status": "enabled"
},
"softDeletePolicy": {
"retentionDays": 90,
"status": "enabled"
}
}
}
}
Configure with Bicep#
To deploy registries that pass this rule:
- Set the
sku.name
property toPremium
orStandard
.
For example:
resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' = {
name: registryName
location: location
sku: {
name: 'Premium'
}
identity: {
type: 'SystemAssigned'
}
properties: {
adminUserEnabled: false
policies: {
quarantinePolicy: {
status: 'enabled'
}
trustPolicy: {
status: 'enabled'
type: 'Notary'
}
retentionPolicy: {
days: 30
status: 'enabled'
}
softDeletePolicy: {
retentionDays: 90
status: 'enabled'
}
}
}
}
Configure with Azure Verified Modules
A pre-validated module supported by Microsoft is available from the Azure Bicep public registry. To reference the module, please use the following syntax:
For example:
To use the latest version:
Links#
- RE:04 Target metrics
- Azure Container Registry SKUs
- Geo-replication in Azure Container Registry
- Best practices for Azure Container Registry
- Azure deployment reference