Let's Talk Cloud: Creating and Configuring Containers in Azure

Hey cloud explorers! Welcome back to our "Let's Talk Cloud" series. Today, we're diving into the exciting world of containers in Azure. If you've been hearing the buzz about containers but haven't taken the plunge yet, or if you're looking to level up your container game in Azure, this post is for you!

Why Containers? The Revolution in Packaging Applications

Before we jump into the Azure-specific details, let's quickly talk about why containers have taken the computing world by storm.

Remember the old days of application deployment? The constant "it works on my machine" problems, the lengthy installation guides, and the nightmare of conflicting dependencies? Containers solve these problems by packaging your application along with everything it needs to run—code, runtime, system tools, libraries—into a single, neat package.

The result? Applications that run consistently across different environments, faster deployments, and more efficient resource utilization. It's no wonder containers have become so popular!

Azure's Container Ecosystem: More Than Just Running Containers

Microsoft Azure offers a rich ecosystem for creating, deploying, and managing containers. Let's explore your main options:

Azure Container Instances (ACI): The Simplest Way to Run Containers

If you're just getting started with containers or need to run a container quickly without managing any infrastructure, Azure Container Instances is your friend. It's a serverless container service that lets you run containers without provisioning VMs or adopting a higher-level orchestration service.

With ACI, you can:

• Deploy containers with a single command

• Pay per second for exactly what you use

• Run Windows or Linux containers

• Deploy multi-container groups that share resources

Setting up a basic container in ACI is as simple as:

az container create --resource-group myResourceGroup --name mycontainer --image mcr.microsoft.com/azuredocs/aci-helloworld --dns-name-label aci-demo --ports 80

This command deploys a simple web server container that's accessible via a public IP address. No VM management, no orchestration complexity—just your container running in the cloud.

Azure Kubernetes Service (AKS): For Production-Grade Container Orchestration

While ACI is great for simple scenarios, most production applications need more advanced features like scaling, load balancing, service discovery, and self-healing. That's where Kubernetes comes in, and Azure Kubernetes Service makes it easy to deploy and manage Kubernetes clusters.

AKS handles the complex Kubernetes control plane for you, so you only pay for and manage the worker nodes where your containers run. This significantly reduces the operational overhead of running Kubernetes.

Some of the key features of AKS include:

• Automatic upgrades and patching

• Self-healing capabilities

• Advanced networking features

• Integration with Azure Active Directory

• Horizontal pod autoscaling

• Cluster autoscaling

Creating a basic AKS cluster is straightforward:

az aks create --resource-group myResourceGroup --name myAKSCluster --node-count 2 --enable-addons monitoring --generate-ssh-keys

Once your cluster is running, you can deploy applications using standard Kubernetes manifests or Helm charts.

Azure Container Registry (ACR): Where Your Container Images Live

Both ACI and AKS need container images to run, and that's where Azure Container Registry comes in. ACR is a managed, private Docker registry service where you can build, store, and manage your container images.

Key features of ACR include:

• Geo-replication for faster image deployment across regions

• Webhook integration for CI/CD pipelines

• Vulnerability scanning

• Image signing with Docker Content Trust

• Task-based image building and patching

Creating a container registry is simple:

az acr create --resource-group myResourceGroup --name myRegistry --sku Basic

After creating your registry, you can push images to it:

az acr login --name myRegistry
docker tag myimage myregistry.azurecr.io/myimage:v1
docker push myregistry.azurecr.io/myimage:v1

Building Container Images in Azure

While you can build container images locally and push them to ACR, Azure also offers several options for building images directly in the cloud:

ACR Tasks: Cloud-Based Container Building

ACR Tasks allows you to build container images in Azure without needing a local Docker installation. This is perfect for CI/CD pipelines and ensuring consistent builds across environments.

For a quick, on-demand build:

az acr build --registry myRegistry --image myapp:v1 .

For automated builds triggered by source code commits or base image updates:

az acr task create --registry myRegistry --name buildTask --image myapp:v1 --context https://github.com/myuser/myapp --file Dockerfile --git-access-token <token>

Azure DevOps Pipelines: End-to-End CI/CD for Containers

For more complex build and deployment workflows, Azure DevOps offers comprehensive CI/CD pipelines with native container support. You can automatically build, test, and deploy your containerized applications whenever code changes are pushed.

A basic pipeline for container builds might look like:

trigger:
- main

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: Docker@2
  inputs:
    containerRegistry: 'myACRConnection'
    repository: 'myapp'
    command: 'buildAndPush'
    Dockerfile: '**/Dockerfile'
    tags: '$(Build.BuildId)'

Container Configuration Best Practices

Now that we've covered the "where" and "how" of running containers in Azure, let's talk about some best practices for configuring your containers:

1. Use Environment Variables for Configuration

Instead of hardcoding configuration values in your container images, use environment variables. This allows you to use the same image across different environments with different configurations:

az container create --resource-group myResourceGroup --name mycontainer --image myregistry.azurecr.io/myapp:v1 --environment-variables 'MYSQL_HOST=mydatabase' 'LOG_LEVEL=info'

For sensitive information, use secure environment variables that won't show up in logs:

az container create --resource-group myResourceGroup --name mycontainer --image myregistry.azurecr.io/myapp:v1 --secure-environment-variables 'DB_PASSWORD=myPassword'

2. Mount Storage for Persistent Data

Containers are ephemeral by nature—when they restart, any changes to the filesystem are lost. For data that needs to persist, use Azure storage:

az container create --resource-group myResourceGroup --name mycontainer --image myregistry.azurecr.io/myapp:v1 --azure-file-volume-share-name myshare --azure-file-volume-account-name mystorageaccount --azure-file-volume-account-key mystoragekey --azure-file-volume-mount-path /data

3. Implement Health Probes

For containers in AKS, implement liveness and readiness probes to help Kubernetes manage your application's lifecycle:

livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

4. Optimize Container Images

Keep your container images as small as possible:

• Use multi-stage builds to separate build-time dependencies from runtime

• Remove unnecessary tools and files

• Use smaller base images when possible (like Alpine Linux)

A multi-stage Dockerfile might look like:

FROM node:14 AS build
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

FROM node:14-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/server.js"]

5. Implement Proper Logging

Configure your applications to output logs to stdout/stderr, which Azure can then collect:

az container create --resource-group myResourceGroup --name mycontainer --image myregistry.azurecr.io/myapp:v1 --log-analytics-workspace myWorkspaceId --log-analytics-workspace-key myWorkspaceKey

For AKS, consider using Azure Monitor for containers to get comprehensive monitoring.

Container Security in Azure

Security is a crucial aspect of containerization. Here are some Azure-specific security practices:

1. Use Managed Identities

Instead of storing credentials in your containers, use managed identities to securely access Azure resources:

az container create --resource-group myResourceGroup --name mycontainer --image myregistry.azurecr.io/myapp:v1 --assign-identity

2. Scan Container Images

Use ACR's vulnerability scanning or integrate with tools like Microsoft Defender for Cloud to identify security issues in your container images.

3. Network Security

For AKS, implement network policies to control pod-to-pod communication:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-policy
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

Are you already using containers in Azure? What challenges have you faced? Drop a comment below—I'd love to hear about your experiences!

Until next time, keep containerizing!