DevOps Peach

Azure Basics · PaaS Compute – App Service, Container Instances and AKS · Lesson 4 of 5

Containers and Azure Container Instances

Containers are lighter than VMs because they share the host kernel, but isolation is weaker; ACI runs a container in seconds with no VM or cluster to manage.

Practice interactively →

Container VM
Isolation Process level, sharing the host kernel — a weaker security boundary Full, with its own kernel
Resources Light, starts fast Heavier, boots an OS
Deployment Docker, an orchestrator (AKS) Portal, CLI, IaC
Storage Volumes (Azure Files, Azure Disks) VM disks
On failure The orchestrator recreates the container on another node The VM restarts on another host 
flowchart TB
  subgraph CG["Container group aci-web (same host)"]
    W["web :80"]
    S["log sidecar :9000"]
    V[("Azure Files volume")]
  end
  I["Internet"] -- "aci-web-lab01.southeastasia.azurecontainer.io" --> W
  W --- V
  S --- V

Azure Container Instances (ACI): the fastest way to run a container on Azure — no VMs, no cluster; billed per second of vCPU/RAM; public IP and DNS name label, custom sizes, persistent storage (Azure Files), Linux/Windows (Windows has fewer features, VNet for example), optional VNet deployment.

Container group: ACI's top-level resource — containers on the same host sharing lifecycle, networking (one IP, different ports) and volumes; good for sidecars.

Traps: containers do not isolate as strongly as VMs; ACI has no orchestration, autoscale or rolling updates like AKS; containers in a group share one IP, so ports must not clash.

Command Meaning
az container create -g rg-devops-lab -n aci-web --image mcr.microsoft.com/azuredocs/aci-helloworld --ports 80 --dns-name-label aci-web-lab01 --os-type Linux --cpu 1 --memory 1.5 Run a container
az container logs -g rg-devops-lab -n aci-web Show logs
az container show -g rg-devops-lab -n aci-web --query ipAddress.fqdn -o tsv Get the FQDN

Restart policies and configuration

Restart policy Behaviour Fits
Always (default) Restarts whenever the container exits Long-running web servers
OnFailure Restarts only on a non-zero exit code Jobs that should retry on error
Never Runs once Batch tasks, one-off scripts

Pass settings with --environment-variables KEY=value, and use --secure-environment-variables for secrets, which are hidden from the portal and API output. Even better, mount secrets from Key Vault or use a managed identity.

Defining a group in YAML

Multi-container groups are easiest to describe in a YAML file deployed with az container create -g rg-devops-lab --file aci.yaml. The file lists each container's image, CPU, memory, ports, and volumes, plus the group's IP address and restart policy. Pulling a private image from ACR can use a managed identity instead of registry passwords.

Working with a running container

az container exec -g rg-devops-lab -n aci-web --exec-command /bin/sh opens a shell inside it, az container attach streams output, and az container restart restarts the group. Logs disappear when the group is deleted, so send them to Log Analytics if you need them later.

ACI, Container Apps, or AKS

Need Choose
Run one container quickly, a batch job, or a CI task ACI
Microservices with HTTPS ingress, autoscale including to zero, revisions Azure Container Apps
Full Kubernetes API, custom controllers, many teams on one platform AKS

ACI is also the engine behind AKS virtual nodes, letting a cluster burst pods into serverless capacity. Because each group is billed per second only while running, ACI is cheap for short tasks but becomes expensive for services that run around the clock compared with a reserved node.

Practice interactively →