Azure Container Apps Notes

Azure Container Apps (ACA) is the Azure no-K8s path, a serverless host over the same image. On AKS, use the Helm chart. This page covers the ACA-specific glue: ingress path split, secrets, the migration one-off, and Flexible Server.

Image registry

Mirror to Azure Container Registry (ACR) for in-region pulls; ACA can also pull from Docker Hub directly.

az acr login --name <your-acr>
docker pull simchasolutions/db-studio:1.0.1
docker tag simchasolutions/db-studio:1.0.1 <your-acr>.azurecr.io/simcha-db-studio:1.0.1
docker push <your-acr>.azurecr.io/simcha-db-studio:1.0.1

Container app essentials

CPU / memory: 1.0 vCPU / 2.0 Gi is a sensible starting size.
Ingress: External, target port 3000. Use a header-based or path-based rule on Azure Front Door / Application Gateway to route /api/* to port 5002 and everything else to port 3000.
Secrets: Use ACA's built-in secret store or Key Vault references. Mount as env vars: JWT_SECRET, ENCRYPTION_KEY, DB_DEVOPS_DB_PASSWORD.
Scaling: ACA's HTTP-based autoscaling on min/max replicas (e.g. min 1, max 5, scale rule = HTTP concurrent requests > 100).
Logs: Stream to Log Analytics workspace by default, query via KQL.

Migrations on ACA

ACA has no native initContainer/pre-deploy hook, so gate the schema change with a one-off Azure Container Instance (ACI) on the same image, command overridden to the runner, before promoting the new revision. Set MIGRATE_ON_BOOT=false on the ACA app so the ACI is the single owner.

# Run migrations as a one-off ACI, overriding the command
az container create \\
  --resource-group <rg> --name dbstudio-migrate \\
  --image <your-acr>.azurecr.io/simcha-db-studio:1.0.1 \\
  --restart-policy Never \\
  --command-line "node dist/server/database/migrate.js" \\
  --environment-variables DB_DEVOPS_DB_HOST=<pg-host> ... \\
  --secure-environment-variables DB_DEVOPS_DB_PASSWORD=<pwd> ...

# Wait for completion, then deploy the new revision to ACA
az container wait --resource-group <rg> --name dbstudio-migrate --condition Terminated

Azure Database for Postgres

Flexible Server is the recommended SKU. Burstable tier (B1ms) suits small teams; General Purpose for production.
Same VNet as ACA via private endpoint, or use a service connector.
SSL is enforced by default, append ?sslmode=require or set PGSSLMODE=require on the container.
Automated backups: default 7 days, configurable.

Updating the container app

# Push the new image tag
docker push <your-acr>.azurecr.io/simcha-db-studio:1.0.2

# Run the migration ACI (see above)

# Promote a new revision in ACA
az containerapp update \\
  --name simcha-db-studio --resource-group <rg> \\
  --image <your-acr>.azurecr.io/simcha-db-studio:1.0.2

ACA's revision-based deploys give you instant rollback if a release misbehaves.

Other Azure paths

AKS, use the Helm chart. See K8s deployment.
App Service for Containers, works for single-host deploys, but lacks the rolling-revision model of ACA. Acceptable for small teams.
VMs with Docker, run docker compose up with the canonical compose file. See Docker deployment.

← AWS ECS Notes

Production & Scaling →