Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 97998e0

Browse files
dlepowdlepow
committedOct 29, 2020
scaffold
1 parent 4102840 commit 97998e0

File tree

4 files changed

+775
-285
lines changed

4 files changed

+775
-285
lines changed
 

‎articles/container-registry/container-registry-tutorial-private-base-image-update.md

Lines changed: 4 additions & 285 deletions
Original file line numberDiff line numberDiff line change
@@ -1,295 +1,14 @@
11
---
2-
title: Tutorial - Trigger image build by private base image update
2+
title:
33
description: In this tutorial, you configure an Azure Container Registry Task to automatically trigger container image builds in the cloud when a base image in another private Azure container registry is updated.
4-
ms.topic: tutorial
5-
ms.date: 01/22/2020
4+
ms.topic: article
5+
ms.date: 10/28/2020
66
ms.custom: devx-track-js, devx-track-azurecli
77
---
88

9-
# Tutorial: Automate container image builds when a base image is updated in another private container registry
10-
11-
ACR Tasks supports automated image builds when a container's [base image is updated](container-registry-tasks-base-images.md), such as when you patch the OS or application framework in one of your base images.
12-
13-
In this tutorial, you learn how to create an ACR task that triggers a build in the cloud when a container's base image is pushed to another Azure container registry. You can also try a tutorial to create an ACR task that triggers an image build when a base image is pushed to the [same Azure container registry](container-registry-tutorial-base-image-update.md).
14-
15-
In this tutorial:
16-
17-
> [!div class="checklist"]
18-
> * Build the base image in a base registry
19-
> * Create an application build task in another registry to track the base image
20-
> * Update the base image to trigger an application image task
21-
> * Display the triggered task
22-
> * Verify updated application image
23-
24-
[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)]
25-
26-
If you'd like to use the Azure CLI locally, you must have the Azure CLI version **2.0.68** or later installed. Run `az --version` to find the version. If you need to install or upgrade the CLI, see [Install Azure CLI][azure-cli].
27-
28-
## Prerequisites
29-
30-
### Complete the previous tutorials
31-
32-
This tutorial assumes you've already completed the steps in the first two tutorials in the series, in which you:
33-
34-
* Create Azure container registry
35-
* Fork sample repository
36-
* Clone sample repository
37-
* Create GitHub personal access token
38-
39-
If you haven't already done so, complete the following tutorials before proceeding:
40-
41-
[Build container images in the cloud with Azure Container Registry Tasks](container-registry-tutorial-quick-task.md)
42-
43-
[Automate container image builds with Azure Container Registry Tasks](container-registry-tutorial-build-task.md)
44-
45-
In addition to the container registry created for the previous tutorials, you need to create a registry to store the base images. If you want to, create the second registry in a different location than the original registry.
46-
47-
### Configure the environment
48-
49-
Populate these shell environment variables with values appropriate for your environment. This step isn't strictly required, but makes executing the multiline Azure CLI commands in this tutorial a bit easier. If you don't populate these environment variables, you must manually replace each value wherever it appears in the example commands.
50-
51-
```azurecli-interactive
52-
BASE_ACR=<base-registry-name> # The name of your Azure container registry for base images
53-
ACR_NAME=<registry-name> # The name of your Azure container registry for application images
54-
GIT_USER=<github-username> # Your GitHub user account name
55-
GIT_PAT=<personal-access-token> # The PAT you generated in the second tutorial
56-
```
57-
58-
### Base image update scenario
59-
60-
This tutorial walks you through a base image update scenario. This scenario reflects a development workflow to manage base images in a common, private container registry when creating application images in other registries. The base images could specify common operating systems and frameworks used by a team, or even common service components.
61-
62-
For example, developers who develop application images in their own registries can access a set of base images maintained in the common base registry. The base registry can be in another region or even geo-replicated.
63-
64-
The [code sample][code-sample] includes two Dockerfiles: an application image, and an image it specifies as its base. In the following sections, you create an ACR task that automatically triggers a build of the application image when a new version of the base image is pushed to a different Azure container registry.
65-
66-
* [Dockerfile-app][dockerfile-app]: A small Node.js web application that renders a static web page displaying the Node.js version on which it's based. The version string is simulated: it displays the contents of an environment variable, `NODE_VERSION`, that's defined in the base image.
67-
68-
* [Dockerfile-base][dockerfile-base]: The image that `Dockerfile-app` specifies as its base. It is itself based on a [Node][base-node] image, and includes the `NODE_VERSION` environment variable.
69-
70-
In the following sections, you create a task, update the `NODE_VERSION` value in the base image Dockerfile, then use ACR Tasks to build the base image. When the ACR task pushes the new base image to your registry, it automatically triggers a build of the application image. Optionally, you run the application container image locally to see the different version strings in the built images.
71-
72-
In this tutorial, your ACR task builds and pushes an application container image specified in a Dockerfile. ACR Tasks can also run [multi-step tasks](container-registry-tasks-multi-step.md), using a YAML file to define steps to build, push, and optionally test multiple containers.
73-
74-
## Build the base image
75-
76-
Start by building the base image with an ACR Tasks *quick task*, using [az acr build][az-acr-build]. As discussed in the [first tutorial](container-registry-tutorial-quick-task.md) in the series, this process not only builds the image, but pushes it to your container registry if the build is successful. In this example, the image is pushed to the base image registry.
77-
78-
```azurecli-interactive
79-
az acr build --registry $BASE_ACR --image baseimages/node:9-alpine --file Dockerfile-base .
80-
```
81-
82-
## Create a task to track the private base image
83-
84-
Next, create a task in the application image registry with [az acr task create][az-acr-task-create], enabling a [managed identity](container-registry-tasks-authentication-managed-identity.md). The managed identity is used in later steps so that the task authenticates with the base image registry.
85-
86-
This example uses a system-assigned identity, but you could create and enable a user-assigned managed identity for certain scenarios. For details, see [Cross-registry authentication in an ACR task using an Azure-managed identity](container-registry-tasks-cross-registry-authentication.md).
87-
88-
```azurecli-interactive
89-
az acr task create \
90-
--registry $ACR_NAME \
91-
--name taskhelloworld \
92-
--image helloworld:{{.Run.ID}} \
93-
--context https://github.com/$GIT_USER/acr-build-helloworld-node.git \
94-
--file Dockerfile-app \
95-
--git-access-token $GIT_PAT \
96-
--arg REGISTRY_NAME=$BASE_ACR.azurecr.io \
97-
--assign-identity
98-
```
99-
100-
101-
This task is similar to the task created in the [previous tutorial](container-registry-tutorial-build-task.md). It instructs ACR Tasks to trigger an image build when commits are pushed to the repository specified by `--context`. While the Dockerfile used to build the image in the previous tutorial specifies a public base image (`FROM node:9-alpine`), the Dockerfile in this task, [Dockerfile-app][dockerfile-app], specifies a base image in the base image registry:
102-
103-
```Dockerfile
104-
FROM ${REGISTRY_NAME}/baseimages/node:9-alpine
105-
```
106-
107-
This configuration makes it easy to simulate a framework patch in the base image later in this tutorial.
108-
109-
## Give identity pull permissions to base registry
110-
111-
To give the task's managed identity permissions to pull images from the base image registry, first run [az acr task show][az-acr-task-show] to get the service principal ID of the identity. Then run [az acr show][az-acr-show] to get the resource ID of the base registry:
112-
113-
```azurecli-interactive
114-
# Get service principal ID of the task
115-
principalID=$(az acr task show --name taskhelloworld --registry $ACR_NAME --query identity.principalId --output tsv)
116-
117-
# Get resource ID of the base registry
118-
baseregID=$(az acr show --name $BASE_ACR --query id --output tsv)
119-
```
120-
121-
Assign the managed identity pull permissions to the registry by running [az role assignment create][az-role-assignment-create]:
122-
123-
```azurecli-interactive
124-
az role assignment create \
125-
--assignee $principalID \
126-
--scope $baseregID --role acrpull
127-
```
128-
129-
## Add target registry credentials to the task
130-
131-
Run [az acr task credential add][az-acr-task-credential-add] to add credentials to the task. Pass the `--use-identity [system]` parameter to indicate that the task's system-assigned managed identity can access the credentials.
132-
133-
```azurecli-interactive
134-
az acr task credential add \
135-
--name taskhelloworld \
136-
--registry $ACR_NAME \
137-
--login-server $BASE_ACR.azurecr.io \
138-
--use-identity [system]
139-
```
140-
141-
## Manually run the task
142-
143-
Use [az acr task run][az-acr-task-run] to manually trigger the task and build the application image. This step is needed so that the task tracks the application image's dependency on the base image.
144-
145-
```azurecli-interactive
146-
az acr task run --registry $ACR_NAME --name taskhelloworld
147-
```
148-
149-
Once the task has completed, take note of the **Run ID** (for example, "da6") if you wish to complete the following optional step.
150-
151-
### Optional: Run application container locally
152-
153-
If you're working locally (not in the Cloud Shell), and you have Docker installed, run the container to see the application rendered in a web browser before you rebuild its base image. If you're using the Cloud Shell, skip this section (Cloud Shell does not support `az acr login` or `docker run`).
154-
155-
First, authenticate to your container registry with [az acr login][az-acr-login]:
156-
157-
```azurecli
158-
az acr login --name $ACR_NAME
159-
```
160-
161-
Now, run the container locally with `docker run`. Replace **\<run-id\>** with the Run ID found in the output from the previous step (for example, "da6"). This example names the container `myapp` and includes the `--rm` parameter to remove the container when you stop it.
162-
163-
```bash
164-
docker run -d -p 8080:80 --name myapp --rm $ACR_NAME.azurecr.io/helloworld:<run-id>
165-
```
166-
167-
Navigate to `http://localhost:8080` in your browser, and you should see the Node.js version number rendered in the web page, similar to the following. In a later step, you bump the version by adding an "a" to the version string.
168-
169-
![Screenshot that shows a sample application rendered in a browser.][base-update-01]
170-
171-
To stop and remove the container, run the following command:
172-
173-
```bash
174-
docker stop myapp
175-
```
176-
177-
## List the builds
178-
179-
Next, list the task runs that ACR Tasks has completed for your registry using the [az acr task list-runs][az-acr-task-list-runs] command:
180-
181-
```azurecli-interactive
182-
az acr task list-runs --registry $ACR_NAME --output table
183-
```
184-
185-
If you completed the previous tutorial (and didn't delete the registry), you should see output similar to the following. Take note of the number of task runs, and the latest RUN ID, so you can compare the output after you update the base image in the next section.
186-
187-
```console
188-
$ az acr task list-runs --registry $ACR_NAME --output table
189-
190-
RUN ID TASK PLATFORM STATUS TRIGGER STARTED DURATION
191-
-------- -------------- ---------- --------- ---------- -------------------- ----------
192-
da6 taskhelloworld Linux Succeeded Manual 2018-09-17T23:07:22Z 00:00:38
193-
da5 Linux Succeeded Manual 2018-09-17T23:06:33Z 00:00:31
194-
da4 taskhelloworld Linux Succeeded Git Commit 2018-09-17T23:03:45Z 00:00:44
195-
da3 taskhelloworld Linux Succeeded Manual 2018-09-17T22:55:35Z 00:00:35
196-
da2 taskhelloworld Linux Succeeded Manual 2018-09-17T22:50:59Z 00:00:32
197-
da1 Linux Succeeded Manual 2018-09-17T22:29:59Z 00:00:57
198-
```
199-
200-
## Update the base image
201-
202-
Here you simulate a framework patch in the base image. Edit **Dockerfile-base**, and add an "a" after the version number defined in `NODE_VERSION`:
203-
204-
```Dockerfile
205-
ENV NODE_VERSION 9.11.2a
206-
```
207-
208-
Run a quick task to build the modified base image. Take note of the **Run ID** in the output.
209-
210-
```azurecli-interactive
211-
az acr build --registry $BASE_ACR --image baseimages/node:9-alpine --file Dockerfile-base .
212-
```
213-
214-
Once the build is complete and the ACR task has pushed the new base image to your registry, it triggers a build of the application image. It may take few moments for the task you created earlier to trigger the application image build, as it must detect the newly built and pushed base image.
215-
216-
## List updated build
217-
218-
Now that you've updated the base image, list your task runs again to compare to the earlier list. If at first the output doesn't differ, periodically run the command to see the new task run appear in the list.
219-
220-
```azurecli-interactive
221-
az acr task list-runs --registry $ACR_NAME --output table
222-
```
223-
224-
Output is similar to the following. The TRIGGER for the last-executed build should be "Image Update", indicating that the task was kicked off by your quick task of the base image.
225-
226-
```console
227-
$ az acr task list-runs --registry $ACR_NAME --output table
228-
229-
Run ID TASK PLATFORM STATUS TRIGGER STARTED DURATION
230-
-------- -------------- ---------- --------- ------------ -------------------- ----------
231-
da8 taskhelloworld Linux Succeeded Image Update 2018-09-17T23:11:50Z 00:00:33
232-
da7 Linux Succeeded Manual 2018-09-17T23:11:27Z 00:00:35
233-
da6 taskhelloworld Linux Succeeded Manual 2018-09-17T23:07:22Z 00:00:38
234-
da5 Linux Succeeded Manual 2018-09-17T23:06:33Z 00:00:31
235-
da4 taskhelloworld Linux Succeeded Git Commit 2018-09-17T23:03:45Z 00:00:44
236-
da3 taskhelloworld Linux Succeeded Manual 2018-09-17T22:55:35Z 00:00:35
237-
da2 taskhelloworld Linux Succeeded Manual 2018-09-17T22:50:59Z 00:00:32
238-
da1 Linux Succeeded Manual 2018-09-17T22:29:59Z 00:00:57
239-
```
240-
241-
If you'd like to perform the following optional step of running the newly built container to see the updated version number, take note of the **RUN ID** value for the Image Update-triggered build (in the preceding output, it's "da8").
242-
243-
### Optional: Run newly built image
244-
245-
If you're working locally (not in the Cloud Shell), and you have Docker installed, run the new application image once its build has completed. Replace `<run-id>` with the RUN ID you obtained in the previous step. If you're using the Cloud Shell, skip this section (Cloud Shell does not support `docker run`).
246-
247-
```bash
248-
docker run -d -p 8081:80 --name updatedapp --rm $ACR_NAME.azurecr.io/helloworld:<run-id>
249-
```
250-
251-
Navigate to http://localhost:8081 in your browser, and you should see the updated Node.js version number (with the "a") in the web page:
252-
253-
![Screenshot of sample application rendered in browser][base-update-02]
254-
255-
What's important to note is that you updated your **base** image with a new version number, but the last-built **application** image displays the new version. ACR Tasks picked up your change to the base image, and rebuilt your application image automatically.
256-
257-
To stop and remove the container, run the following command:
258-
259-
```bash
260-
docker stop updatedapp
261-
```
2629

26310
## Next steps
26411

265-
In this tutorial, you learned how to use a task to automatically trigger container image builds when the image's base image has been updated. Now, move on to the next tutorial to learn how to trigger tasks on a defined schedule.
266-
267-
> [!div class="nextstepaction"]
268-
> [Run a task on a schedule](container-registry-tasks-scheduled.md)
269-
270-
<!-- LINKS - External -->
271-
[base-alpine]: https://hub.docker.com/_/alpine/
272-
[base-dotnet]: https://hub.docker.com/r/microsoft/dotnet/
273-
[base-node]: https://hub.docker.com/_/node/
274-
[base-windows]: https://hub.docker.com/r/microsoft/nanoserver/
275-
[code-sample]: https://github.com/Azure-Samples/acr-build-helloworld-node
276-
[dockerfile-app]: https://github.com/Azure-Samples/acr-build-helloworld-node/blob/master/Dockerfile-app
277-
[dockerfile-base]: https://github.com/Azure-Samples/acr-build-helloworld-node/blob/master/Dockerfile-base
12+
In this tutorial, you learned how to ....
27813

279-
<!-- LINKS - Internal -->
280-
[azure-cli]: /cli/azure/install-azure-cli
281-
[az-acr-build]: /cli/azure/acr#az-acr-build
282-
[az-acr-task-create]: /cli/azure/acr/task#az-acr-task-create
283-
[az-acr-task-update]: /cli/azure/acr/task#az-acr-task-update
284-
[az-acr-task-run]: /cli/azure/acr/task#az-acr-task-run
285-
[az-acr-task-show]: /cli/azure/acr/task#az-acr-task-show
286-
[az-acr-task-credential-add]: /cli/azure/acr/task/credential#az-acr-task-credential-add
287-
[az-acr-login]: /cli/azure/acr#az-acr-login
288-
[az-acr-task-list-runs]: /cli/azure/acr/task#az-acr-task-list-runs
289-
[az-acr-task]: /cli/azure/acr#az-acr-task
290-
[az-acr-show]: /cli/azure/acr#az-acr-show
291-
[az-role-assignment-create]: /cli/azure/role/assignment#az-role-assignment-create
29214

293-
<!-- IMAGES -->
294-
[base-update-01]: ./media/container-registry-tutorial-base-image-update/base-update-01.png
295-
[base-update-02]: ./media/container-registry-tutorial-base-image-update/base-update-02.png

‎articles/container-registry/tasks-consume-public-content.md

Lines changed: 771 additions & 0 deletions
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)
Please sign in to comment.