Skip to content

Commit 8e5b592

Browse files
chasedmicrosoftchasedmicrosoft
committed
update images
1 parent b3df607 commit 8e5b592

6 files changed

+7
-271
lines changed

‎articles/reliability/media/reliability-acr/acr-geo-replication-failover.png

255 KB
Loading

‎articles/reliability/media/reliability-acr/acr-geo-replication-healthy-ops.png

248 KB
Loading

‎articles/reliability/media/reliability-acr/acr-reliability-architecture-overview.png

173 KB
Loading

‎articles/reliability/media/reliability-acr/acr-zone-redundancy-failover.png

180 KB
Loading

‎articles/reliability/media/reliability-acr/acr-zone-redundancy-healthy-ops.png

128 KB
Loading

‎articles/reliability/reliability-container-registry.md

Lines changed: 7 additions & 271 deletions
Original file line numberDiff line numberDiff line change
@@ -36,48 +36,7 @@ Azure Container Registry is built on Azure's distributed infrastructure to provi
3636

3737
The service provides built-in redundancy through zone redundancy within regions and geo-replication across regions. Zone redundancy automatically distributes data across multiple availability zones, while geo-replication creates independent registry replicas in customer-selected regions. Both features are available in the Premium tier and work together to provide comprehensive protection against infrastructure failures.
3838

39-
```mermaid
40-
graph TB
41-
subgraph "Azure Container Registry Architecture"
42-
subgraph "Control Plane"
43-
CP[Registry Configuration<br/>- Authentication<br/>- Network Rules<br/>- Geo-replication Settings<br/>- Zone Redundancy Config]
44-
end
45-
46-
subgraph "Data Plane"
47-
API[Registry API Server<br/>- Push/Pull Operations<br/>- Image Management<br/>- Artifact Storage]
48-
end
49-
50-
subgraph "Storage Layer"
51-
AS[Azure Storage<br/>- Container Images<br/>- Artifacts<br/>- Manifests<br/>- Encrypted at Rest]
52-
end
53-
54-
subgraph "Zone Redundancy (Premium Tier)"
55-
Z1[Availability Zone 1<br/>Registry Replica]
56-
Z2[Availability Zone 2<br/>Registry Replica]
57-
Z3[Availability Zone 3<br/>Registry Replica]
58-
end
59-
60-
subgraph "Geo-Replication (Premium Tier)"
61-
R1[Region 1<br/>Primary Registry]
62-
R2[Region 2<br/>Registry Replica]
63-
R3[Region 3<br/>Registry Replica]
64-
end
65-
end
66-
67-
CP --> API
68-
API --> AS
69-
API --> Z1
70-
API --> Z2
71-
API --> Z3
72-
73-
R1 -.->|Async Replication| R2
74-
R1 -.->|Async Replication| R3
75-
R2 -.->|Content-Addressable<br/>Storage Sync| R3
76-
77-
Z1 <-->|Synchronous<br/>Replication| Z2
78-
Z2 <-->|Synchronous<br/>Replication| Z3
79-
Z1 <-->|Synchronous<br/>Replication| Z3
80-
```
39+
:::image type="content" source="./media/reliability-acr/acr-reliability-architecture-overview.png" alt-text="Diagram that shows Azure Container Registry architecture with control plane, data plane, storage layer, zone redundancy across availability zones, and geo-replication across regions." border="false" lightbox="./media/reliability-acr/acr-reliability-architecture-overview.png":::
8140

8241
### Regional storage
8342

@@ -152,120 +111,17 @@ Zone redundancy is automatically enabled when you create a Premium registry in a
152111

153112
During normal operations with zone redundancy enabled, Azure Container Registry automatically distributes registry operations across multiple availability zones. Container image pushes and pulls are load-balanced across zones to optimize performance and ensure high availability. For operational details, see [Azure Container Registry best practices](/azure/container-registry/container-registry-best-practices).
154113

155-
```mermaid
156-
graph LR
157-
subgraph "Client Applications"
158-
C1[Docker Client 1]
159-
C2[Kubernetes Cluster]
160-
C3[CI/CD Pipeline]
161-
end
162-
163-
subgraph "Load Balancer"
164-
LB[Azure Load Balancer<br/>Active-Active Distribution]
165-
end
166-
167-
subgraph "Azure Container Registry - Zone Redundant"
168-
subgraph "Zone 1"
169-
ACR1[Registry Endpoint<br/>Zone 1<br/>- Push/Pull Operations<br/>- API Requests]
170-
S1[Storage Replica 1]
171-
end
172-
173-
subgraph "Zone 2"
174-
ACR2[Registry Endpoint<br/>Zone 2<br/>- Push/Pull Operations<br/>- API Requests]
175-
S2[Storage Replica 2]
176-
end
177-
178-
subgraph "Zone 3"
179-
ACR3[Registry Endpoint<br/>Zone 3<br/>- Push/Pull Operations<br/>- API Requests]
180-
S3[Storage Replica 3]
181-
end
182-
end
183-
184-
C1 --> LB
185-
C2 --> LB
186-
C3 --> LB
187-
188-
LB -->|Route to Healthy Zones| ACR1
189-
LB -->|Route to Healthy Zones| ACR2
190-
LB -->|Route to Healthy Zones| ACR3
191-
192-
ACR1 --> S1
193-
ACR2 --> S2
194-
ACR3 --> S3
195-
196-
S1 <-->|Synchronous<br/>Replication| S2
197-
S2 <-->|Synchronous<br/>Replication| S3
198-
S1 <-->|Synchronous<br/>Replication| S3
199-
200-
style ACR1 fill:#90EE90
201-
style ACR2 fill:#90EE90
202-
style ACR3 fill:#90EE90
203-
```
204-
205-
**Traffic routing between zones**. Container Registry uses an active-active approach where registry operations are distributed across all available zones. The service automatically routes requests to healthy zones and load-balances traffic to optimize performance.
114+
:::image type="content" source="./media/reliability-acr/acr-zone-redundancy-healthy-ops.png" alt-text="Diagram that shows normal zone redundancy operations with clients connecting to a single registry endpoint that automatically routes traffic across three availability zones." border="false" lightbox="./media/reliability-acr/acr-zone-redundancy-healthy-ops.png":::
115+
116+
**Traffic routing between zones**. Container Registry automatically distributes registry operations across all available zones through its built-in service architecture. The registry service automatically routes requests to healthy zones without requiring external load balancers.
206117

207118
**Data replication between zones**. Registry data including container images, manifests, and metadata are synchronously replicated across multiple availability zones. Changes are committed only after successful replication to multiple zones, ensuring data consistency and durability. For storage details, see [Container image storage in Azure Container Registry](/azure/container-registry/container-registry-storage).
208119

209120
### Zone-down experience
210121

211122
When a zone becomes unavailable, Azure Container Registry automatically handles the failover process with minimal impact to registry operations:
212123

213-
```mermaid
214-
graph LR
215-
subgraph "Client Applications"
216-
C1[Docker Client 1]
217-
C2[Kubernetes Cluster]
218-
C3[CI/CD Pipeline]
219-
end
220-
221-
subgraph "Microsoft-Managed Detection"
222-
MD[Automatic Zone<br/>Health Detection<br/>- Service Health Monitoring<br/>- Azure Monitor Metrics]
223-
end
224-
225-
subgraph "Azure Container Registry - Zone Failover"
226-
subgraph "Zone 1 - FAILED"
227-
ACR1[Registry Endpoint<br/>Zone 1<br/>🔴 UNAVAILABLE]
228-
S1[Storage Replica 1<br/>🔴 INACCESSIBLE]
229-
end
230-
231-
subgraph "Zone 2 - HEALTHY"
232-
ACR2[Registry Endpoint<br/>Zone 2<br/>✅ ACTIVE<br/>- Handling Increased Load<br/>- Auto-Retry from Zone 1]
233-
S2[Storage Replica 2<br/>✅ OPERATIONAL]
234-
end
235-
236-
subgraph "Zone 3 - HEALTHY"
237-
ACR3[Registry Endpoint<br/>Zone 3<br/>✅ ACTIVE<br/>- Handling Increased Load<br/>- Auto-Retry from Zone 1]
238-
S3[Storage Replica 3<br/>✅ OPERATIONAL]
239-
end
240-
end
241-
242-
subgraph "Automatic Traffic Rerouting"
243-
TR[Traffic Rerouter<br/>- Automatic Failover<br/>- Load Balancing<br/>- No Config Changes Required]
244-
end
245-
246-
C1 --> TR
247-
C2 --> TR
248-
C3 --> TR
249-
250-
MD -->|Detects Zone 1 Failure| TR
251-
TR -.->|Traffic Blocked| ACR1
252-
TR -->|Redirect Traffic| ACR2
253-
TR -->|Redirect Traffic| ACR3
254-
255-
ACR2 --> S2
256-
ACR3 --> S3
257-
258-
S2 <-->|Maintains Sync<br/>Data Consistency| S3
259-
260-
style ACR1 fill:#FFB6C1
261-
style S1 fill:#FFB6C1
262-
style ACR2 fill:#90EE90
263-
style ACR3 fill:#90EE90
264-
style S2 fill:#90EE90
265-
style S3 fill:#90EE90
266-
style MD fill:#87CEEB
267-
style TR fill:#DDA0DD
268-
```
124+
:::image type="content" source="./media/reliability-acr/acr-zone-redundancy-failover.png" alt-text="Diagram that shows zone failover scenario where Zone 1 fails and Azure Container Registry automatically routes traffic to healthy zones 2 and 3." border="false" lightbox="./media/reliability-acr/acr-zone-redundancy-failover.png":::
269125

270126
- **Detection and response**. Microsoft-managed automatic detection and failover occur when a zone becomes unavailable. The service automatically routes traffic to remaining healthy zones.
271127
- **Notification**. Zone-level outages are reflected in Azure Service Health and Azure Monitor metrics. Configure alerts on registry availability metrics to monitor zone health. For monitoring setup, see [Monitor Azure Container Registry](/azure/container-registry/monitor-service).
@@ -290,59 +146,7 @@ Unlike many Azure services, Container Registry geo-replication does not use Azur
290146

291147
Geo-replication automatically synchronizes container images and artifacts across all configured regions. The service uses content-addressable storage to efficiently replicate only the unique image layers, minimizing bandwidth usage and replication time. Registry operations are automatically routed to the nearest regional endpoint for optimal performance. For storage concepts, see [Container image storage in Azure Container Registry](/azure/container-registry/container-registry-storage).
292148

293-
```mermaid
294-
graph TB
295-
subgraph "Global Clients"
296-
direction TB
297-
C1[Clients in Region 1<br/>- AKS Clusters<br/>- Docker Clients<br/>- CI/CD Pipelines]
298-
C2[Clients in Region 2<br/>- AKS Clusters<br/>- Docker Clients<br/>- CI/CD Pipelines]
299-
C3[Clients in Region 3<br/>- AKS Clusters<br/>- Docker Clients<br/>- CI/CD Pipelines]
300-
end
301-
302-
subgraph "Traffic Manager"
303-
TM[Azure Traffic Manager<br/>- DNS-based routing<br/>- Nearest endpoint selection<br/>- Health monitoring]
304-
end
305-
306-
subgraph "Primary Region (Home)"
307-
subgraph "Region 1 - East US"
308-
PR[Primary Registry<br/>myregistry.azurecr.io<br/>✅ Control + Data Plane<br/>- All registry operations<br/>- Management operations]
309-
PS[Storage Layer 1<br/>- Container Images<br/>- Manifests<br/>- Artifacts]
310-
end
311-
end
312-
313-
subgraph "Replica Regions"
314-
subgraph "Region 2 - West Europe"
315-
RR2[Registry Replica<br/>myregistry.azurecr.io<br/>✅ Data Plane Only<br/>- Push/Pull operations<br/>- Read operations]
316-
RS2[Storage Layer 2<br/>- Replicated Images<br/>- Synchronized Manifests<br/>- Local Artifacts]
317-
end
318-
319-
subgraph "Region 3 - East Asia"
320-
RR3[Registry Replica<br/>myregistry.azurecr.io<br/>✅ Data Plane Only<br/>- Push/Pull operations<br/>- Read operations]
321-
RS3[Storage Layer 3<br/>- Replicated Images<br/>- Synchronized Manifests<br/>- Local Artifacts]
322-
end
323-
end
324-
325-
C1 --> TM
326-
C2 --> TM
327-
C3 --> TM
328-
329-
TM -->|Routes to nearest| PR
330-
TM -->|Routes to nearest| RR2
331-
TM -->|Routes to nearest| RR3
332-
333-
PR --> PS
334-
RR2 --> RS2
335-
RR3 --> RS3
336-
337-
PS -.->|Async Replication<br/>Content-Addressable<br/>Unique Layers Only| RS2
338-
PS -.->|Async Replication<br/>Content-Addressable<br/>Unique Layers Only| RS3
339-
RS2 -.->|Cross-region Sync| RS3
340-
341-
style PR fill:#FFD700
342-
style RR2 fill:#90EE90
343-
style RR3 fill:#90EE90
344-
style TM fill:#87CEEB
345-
```
149+
:::image type="content" source="./media/reliability-acr/acr-geo-replication-healthy-ops.png" alt-text="Diagram that shows geo-replication architecture with global clients connecting to primary and replica registries across multiple regions with asynchronous replication." border="false" lightbox="./media/reliability-acr/acr-geo-replication-healthy-ops.png":::
346150

347151
### Region support
348152

@@ -382,75 +186,7 @@ During normal multi-region operations, Azure Container Registry synchronizes dat
382186

383187
When a region becomes unavailable, container operations can continue using alternative regional endpoints:
384188

385-
```mermaid
386-
graph TB
387-
subgraph "Client Applications"
388-
direction TB
389-
C1[AKS Cluster<br/>Primary Region]
390-
C2[CI/CD Pipeline<br/>Primary Region]
391-
C3[Docker Client<br/>Primary Region]
392-
end
393-
394-
subgraph "Health Monitoring"
395-
HM[Application Health Checks<br/>- Registry endpoint monitoring<br/>- DNS resolution tests<br/>- Container pull/push validation]
396-
end
397-
398-
subgraph "Before Outage - Normal Operations"
399-
subgraph "Primary Region - East US"
400-
PR1[✅ Primary Registry<br/>myregistry.azurecr.io<br/>- All operations available<br/>- Lowest latency]
401-
end
402-
403-
subgraph "Secondary Region - West Europe"
404-
RR1[✅ Replica Registry<br/>myregistry.azurecr.io<br/>- Data plane operations<br/>- Standby ready]
405-
end
406-
407-
subgraph "Tertiary Region - East Asia"
408-
RR2[✅ Replica Registry<br/>myregistry.azurecr.io<br/>- Data plane operations<br/>- Standby ready]
409-
end
410-
end
411-
412-
subgraph "After Outage - Failover State"
413-
subgraph "Primary Region - East US"
414-
PR2[🔴 Primary Registry<br/>myregistry.azurecr.io<br/>- Region unavailable<br/>- DNS resolution fails<br/>- Network timeouts]
415-
end
416-
417-
subgraph "Secondary Region - West Europe"
418-
RR3[✅ Active Replica Registry<br/>myregistry.azurecr.io<br/>- Handling redirected traffic<br/>- All data plane operations<br/>- Increased load]
419-
end
420-
421-
subgraph "Tertiary Region - East Asia"
422-
RR4[✅ Active Replica Registry<br/>myregistry.azurecr.io<br/>- Handling redirected traffic<br/>- All data plane operations<br/>- Increased load]
423-
end
424-
end
425-
426-
subgraph "Failover Logic"
427-
FL[Application Failover<br/>- Automatic endpoint switching<br/>- Retry logic with backoff<br/>- Health check validation<br/>- Load balancing]
428-
end
429-
430-
C1 --> HM
431-
C2 --> HM
432-
C3 --> HM
433-
434-
HM -.->|Normal State<br/>Primary endpoint| PR1
435-
HM -.->|Detects failure<br/>Switches to replica| RR3
436-
HM -.->|Load balancing<br/>Multiple replicas| RR4
437-
438-
PR1 -.->|Async replication| RR1
439-
RR1 -.->|Cross-region sync| RR2
440-
441-
HM -->|Triggers failover| FL
442-
FL -->|Redirects traffic| RR3
443-
FL -->|Redirects traffic| RR4
444-
445-
style PR1 fill:#90EE90
446-
style RR1 fill:#87CEEB
447-
style RR2 fill:#87CEEB
448-
style PR2 fill:#FFB6C1
449-
style RR3 fill:#98FB98
450-
style RR4 fill:#98FB98
451-
style HM fill:#DDA0DD
452-
style FL fill:#F0E68C
453-
```
189+
:::image type="content" source="./media/reliability-acr/acr-geo-replication-failover.png" alt-text="Diagram that shows regional failover scenario where primary region becomes unavailable and application health monitoring triggers failover to replica regions." border="false" lightbox="./media/reliability-acr/acr-geo-replication-failover.png":::
454190

455191
- **Detection and response**. Customer applications are responsible for detecting regional endpoint unavailability and switching to alternative regions. Configure health checks and failover logic in your container orchestration platforms. For monitoring guidance, see [Monitor Azure Container Registry](/azure/container-registry/monitor-service).
456192
- **Notification**. Regional outages are reported through Azure Service Health. Monitor registry availability metrics for each regional endpoint to detect issues. For service health information, see [Azure Service Health](/azure/service-health/).

0 commit comments

Comments
 (0)