Merge pull request #303481 from mattchenderson/linux-containers

adding example recommended base image tags

Author: prmerger-automator[bot]

articles/azure-functions/container-concepts.md

@@ -73,9 +73,24 @@ When creating your own containers, you're required to keep the base image of you
 
 The Functions team is committed to publishing monthly updates for these base images. Regular updates include the latest minor version updates and security fixes for both the Functions runtime and languages. You should regularly update your container from the latest base image and redeploy the updated version of your container. 
 
-When the base image is managed by Functions, such as in a standard deployment on Linux, your app is kept up to date automatically by the regular base image updates released by the Functions team. For such noncustomized containers, your app gets updated to run on the base image that has the new minor version or patched version of the host runtime. 
+Choose your base image based on the language stack you're using in your function app. The following table provides examples for each stack. In general, the tag should start with `4-` to indicate the V4 Functions runtime. When new minor versions are released, this tag will be updated to point to the new version. As you periodically rebuild your custom image, you will pull the new versions through that same tag, allowing your app to have the same updates. You shouldn't use tags that specify minor runtime versions, as these will not receive updates, and your app will potentially remain on an unpatched version, no matter how often you rebuild your custom image.
 
-When you create or deploy your own containerized app using a custom image, you're responsible for making sure that your custom image staying up-to-date with our released base images. In addition to new features and improvements, these base image updates can also include security updates that are critical for your app. To ensure your app is protected, you make sure you're staying up to date.
+| Language Stack | Example recommended base image tags |
+|----------------|----------------|
+| .NET (isolated worker model) | `mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated8.0` or<br/>`mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated8.0-appservice`<br/><br/>(These examples target .NET 8. Select the appropriate image for the .NET version you need.) |
+| .NET (legacy in-process model) | `mcr.microsoft.com/azure-functions/dotnet:4-dotnet8.0` or<br/>`mcr.microsoft.com/azure-functions/dotnet:4-dotnet8.0-appservice`<br/><br/>(Support will end for the in-process model on November 10, 2026. You should [migrate to the isolated worker model](https://aka.ms/af-dotnet-isolated-migration) as soon as possible.) |
+| Java | `mcr.microsoft.com/azure-functions/java:4-java21` or<br/>`mcr.microsoft.com/azure-functions/java:4-java21-appservice`<br/><br/>(These examples target Java 21. Select the appropriate image for the Java version you need.) |
+| Node.js (JavaScript or TypeScript) | `mcr.microsoft.com/azure-functions/node:4-node22` or<br/>`mcr.microsoft.com/azure-functions/node:4-node22-appservice`<br/><br/>(These examples target Node.js 22. Select the appropriate image for the Node.js version you need.) |
+| PowerShell | `mcr.microsoft.com/azure-functions/powershell:4-powershell7.4` or<br/>`mcr.microsoft.com/azure-functions/powershell:4-powershell7.4-appservice`<br/><br/>(These examples target PowerShell 7.4. Select the appropriate image for the PowerShell version you need.) |
+| Python | `mcr.microsoft.com/azure-functions/python:4-python3.12` or<br/>`mcr.microsoft.com/azure-functions/python:4-python3.12-appservice`<br/><br/>(These examples target Python 3.12. Select the appropriate image for the Python version you need.) |
+| Custom handlers / other | `mcr.microsoft.com/azure-functions/base:4` or<br/>`mcr.microsoft.com/azure-functions/base:4-appservice` |
+
+Base images ending in `-appservice` enable SSH and remote debugging from the platform. Unless you need these capabilities, you can use the base images without the `-appservice` suffix.
+
+> [!IMPORTANT]
+> It isn't sufficient to just have one of the above tags in your Dockerfile. You need to regularly pull the latest image from that tag so that your custom image can be rebuilt to include the latest updates. If you don't pull the latest image and rebuild, your app will continue to run on the old base image.
+
+When you create or deploy your own containerized app using a custom image, you're responsible for making sure that your custom image staying up-to-date with our released base images. In addition to new features and improvements, these base image updates can also include security updates that are critical for your app. To ensure your app is protected, make sure you're staying up to date. You should regularly pull the latest version of the base image, rebuild your custom container image, and redeploy your app to use it.
 
 In some cases, we're required to make platform-level changes that could mean that an app in a custom container using an old base image might stop working properly. For such major changes, we roll out updated images well in advance so that apps that take regular updates aren't negatively impacted. To avoid potential problems with your apps running in custom containers, make sure you don't fall too far behind the latest minor version released. During a support case, should we determine that your app is experiencing problems because it's on an older or unsupported version, we do request that you update your container to the latest base image version before continuing with support.