09 - Container Deployment (Premium)¶

Package your Python function app as a Linux container, push it to Azure Container Registry, and deploy it to a Premium plan with a managed-identity registry pull.

Which Plans Support Custom Containers?¶

Custom container images are not available on every hosting plan. Choose your target deliberately:

Prerequisites¶

What You'll Build¶

You will add a Dockerfile to the Python app, build and push the image to ACR, create a Premium plan function app configured to pull that image, and grant the app's managed identity AcrPull so it authenticates without registry passwords.

1. Generate the Dockerfile¶

func init --docker-only

This adds a Dockerfile deriving from the official Python base image:

FROM mcr.microsoft.com/azure-functions/python:4-python3.11

ENV AzureWebJobsScriptRoot=/home/site/wwwroot \
    AzureFunctionsJobHost__Logging__Console__IsEnabled=true

COPY requirements.txt /
RUN pip install --no-cache-dir -r /requirements.txt

COPY . /home/site/wwwroot

2. Build and Push to Azure Container Registry¶

Build the image directly in ACR (no local Docker required):

az acr create --resource-group $RG --name $REGISTRY_NAME --sku Basic
az acr build --registry $REGISTRY_NAME --image functions/python-app:v1.0.0 .

3. Create the Premium Plan and Function App¶

az functionapp plan create --resource-group $RG --name $PLAN_NAME \
  --location $LOCATION --sku EP1 --is-linux

az functionapp create --resource-group $RG --name $APP_NAME \
  --storage-account $STORAGE_NAME --plan $PLAN_NAME \
  --functions-version 4 --runtime python \
  --image $REGISTRY_NAME.azurecr.io/functions/python-app:v1.0.0 \
  --assign-identity "[system]"

4. Grant Managed-Identity Registry Pull¶

Avoid storing registry credentials — let the app's system-assigned identity pull the image.

PRINCIPAL_ID=$(az functionapp identity show --resource-group $RG --name $APP_NAME --query principalId --output tsv)
REGISTRY_ID=$(az acr show --name $REGISTRY_NAME --query id --output tsv)

az role assignment create --assignee $PRINCIPAL_ID --role AcrPull --scope $REGISTRY_ID
az resource update --ids "$(az functionapp show --resource-group $RG --name $APP_NAME --query id --output tsv)/config/web" \
  --set properties.acrUseManagedIdentityCreds=true

5. Update the Image¶

Rebuild with a new tag and point the app at it:

az acr build --registry $REGISTRY_NAME --image functions/python-app:v1.0.1 .
az functionapp config container set --resource-group $RG --name $APP_NAME \
  --image $REGISTRY_NAME.azurecr.io/functions/python-app:v1.0.1

Verification¶

• [ ] az acr build completes and the image appears in az acr repository list --name $REGISTRY_NAME.
• [ ] The function app starts and serves requests from the container image.
• [ ] az functionapp config container show reports the expected image, and acrUseManagedIdentityCreds is true (no stored registry password).

Next Steps¶

• Automate build-and-push in your pipeline — see 06 - CI/CD.
• For webhook-based redeploys, evaluate the Dedicated plan or Azure Container Apps.

See Also¶

• 08 - Testing and Debugging — Test before you containerize
• Work with Azure Functions in containers
• Azure Functions on Azure Container Apps

Sources¶

• Work with Azure Functions in containers (Microsoft Learn)
• Create a function app in a local Linux container (Microsoft Learn)
• Azure Container Apps hosting of Azure Functions (Microsoft Learn)