Containers
ACI · Container Apps · AKS · App Service
Practice questions for this topic →
Decision table
| Service | Model | Scale to zero | Pick when… |
|---|---|---|---|
| Container Instances | Single pod of Hyper-V isolated containers, no orchestration | Per-second billing while running | Simple, short-lived or burst containers |
| Container Apps | Serverless platform built on Kubernetes with Dapr, KEDA and Envoy; no Kubernetes API access | Most apps (not those scaling on CPU or memory) | Microservices, event-driven apps, jobs, HTTP APIs |
| AKS | Managed Kubernetes: Automatic or Standard mode | No (system nodes run) | Kubernetes API, Helm, CRDs, operators, deep control |
| App Service | Fully managed web app host (code or containers) | No | Web apps and APIs |
| Functions on Container Apps | Triggers, bindings and automatic scaling beside other microservices | Yes | Functions next to other containers |
Container Apps details
- Scales on HTTP traffic, event-driven processing, CPU or memory load, or any KEDA-supported scaler. Most apps can scale to zero; apps that scale on CPU or memory can't.
- Apps vs jobs: apps run continuously and restart on failure; jobs run for a finite duration and stop. Job triggers: manual, schedule (cron) or event. Jobs and apps share an environment. Roles: Container Apps Jobs Contributor (create/manage) and Jobs Operator (read, start, stop).
- Also: HTTPS or TCP ingress, internal ingress with DNS-based service discovery, traffic splitting across revisions (blue/green, A/B), Dapr, secrets, your own VNet, any registry.
Container Instances (ACI)
- Starts containers in seconds, billed per second, with custom CPU and memory sizes; Linux and Windows; several containers in a container group; regular, confidential and Spot containers.
- Hypervisor-level isolation. Requires TLS 1.2 (1.0 and 1.1 retired). It has no built-in scaling or load balancing: more instances means more container groups (or NGroups). Virtual nodes let AKS burst pods into ACI.
AKS details
| Item | Fact |
|---|---|
| Modes | AKS Automatic (production-ready defaults, Standard tier, uptime SLA and pod-readiness SLA) vs AKS Standard (maximum control) |
| Free tier | Dev/test; best-effort uptime with no financially backed SLA; up to 1,000 nodes |
| Standard tier | Production; uptime SLA by default (API server 99.95% with availability zones, 99.9% without); up to 5,000 nodes |
| Premium tier | Standard plus 24-month Long Term Support Kubernetes versions |
| Virtual nodes | Pods run in ACI; Linux only; need Azure CNI; no DaemonSets, init containers or managed identities on them. Virtual Nodes v2 is in preview |
| Azure Linux 2.0 | No security updates since Nov 30, 2025; node images are removed Oct 31, 2026 and node pools can't scale: move to a supported Azure Linux version (AzureLinux3) |
Azure Container Registry
- Geo-replication needs the Premium SKU. One registry, one name, active-active (push, pull and delete in any replica), eventually consistent: a push followed by an immediate pull from another region can fail with 'manifest unknown'. Pull with a managed identity, not admin credentials.
Exam Tips
Tick each tip once you can answer it without looking.
“Microservices + minimize management overhead + scale to zero” → Azure Container Apps. Trap: AKS adds cluster management overhead.
“Needs direct Kubernetes API access, Helm charts or custom CRDs” → AKS. Trap: Container Apps doesn't expose the Kubernetes API.
“Run a container nightly for a short batch job, cheapest option” → ACI. Trap: ACI has no autoscale or load balancing; 5 instances = 5 separate container groups.
“Scheduled or on-demand container jobs without a cluster” → Container Apps jobs.
“Scale containers on queue length or other event sources” → Container Apps (built-in KEDA).
“AKS needs burst capacity without adding nodes” → Virtual nodes (backed by ACI).
“Web app shipped as a container, needs deployment slots” → App Service (containers).
“Private registry replicated to multiple regions” → Azure Container Registry Premium (geo-replication). Trap: Pull images with a managed identity, not admin credentials.
“Service discovery, pub/sub and state abstractions between microservices” → Dapr in Container Apps.
“Container Apps apps that can scale to zero” → Apps scaling on HTTP or event triggers (most apps). Trap: Apps that scale on CPU or memory can't scale to zero.
“Container Apps app versus job” → Apps run continuously and restart on failure; jobs run to completion on manual, schedule or event triggers. Trap: Roles: Container Apps Jobs Contributor and Jobs Operator.
“Container Instances capabilities” → Starts in seconds, per-second billing, custom CPU and memory, container groups, hypervisor isolation, TLS 1.2 required. Trap: No built-in scaling or load balancing: more instances means more container groups.
“AKS pricing tiers” → Free: no financially backed SLA, up to 1,000 nodes. Standard: uptime SLA, up to 5,000 nodes. Premium: adds 24-month LTS. Trap: API server SLA 99.95% with availability zones, 99.9% without.
“AKS Automatic versus Standard mode” → Automatic: production defaults, Standard tier, uptime SLA and pod-readiness SLA. Standard mode: deeper control. Trap: Both modes share the same Kubernetes concepts.
“AKS virtual nodes limits” → Pods run in ACI; Linux only; need Azure CNI; no DaemonSets, init containers or managed identities. Trap: Virtual Nodes v2 is in preview.
“Container Registry geo-replication” → Premium SKU; one registry name; active-active; eventually consistent. Trap: A push then an immediate pull from another region can fail with manifest unknown.
“Azure Linux 2.0 node images on AKS” → No security updates since Nov 30, 2025; images removed Oct 31, 2026 and node pools can't scale; move to AzureLinux3. Trap: Upgrade the node pool to a supported version.