Deploy an application with a custom container image

This article applies to: ✔️ Standard ✔️ Enterprise

This article explains how to deploy Spring Boot applications in Azure Spring Apps using a custom container image. Deploying an application with a custom container supports most features as when deploying a JAR application. Other Java and non-Java applications can also be deployed with the container image.

Prerequisites

• A container image containing the application.
• The image is pushed to an image registry. For more information, see Azure Container Registry.

Deploy your application

To deploy an application to a custom container image, use the following steps:

    --container-command "java" \
    --container-args "-jar /app.jar -Dkey=value"

    --disable-probe true

Feature Support matrix

The following matrix shows what features are supported in each application type.

Common points to be aware of when deploying with a custom container

The following points will help you address common situations when deploying with a custom image.

Trust a Certificate Authority

There are two options to trust a Certificate Authority:

Option 1: Upload via Azure Spring Apps

To load the CA certs into your apps, see Use TLS/SSL certificates in your application in Azure Spring Apps. Then the certs will be mounted into the location /etc/azure-spring-cloud/certs/public/.

Option 2: Manual installation in the image

To trust a CA in the image, set the following variables depending on your environment:

• You must import Java applications into the trust store by adding the following lines into your Dockerfile:

  ADD EnterpriseRootCA.crt /opt/
  RUN keytool -keystore /etc/ssl/certs/java/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias EnterpriseRootCA -file /opt/EnterpriseRootCA.crt
  

• For Node.js applications, set the NODE_EXTRA_CA_CERTS environment variable:

  ADD EnterpriseRootCA.crt /opt/
  ENV NODE_EXTRA_CA_CERTS="/opt/EnterpriseRootCA.crt"
  

• For Python, or other languages relying on the system CA store, on Debian or Ubuntu images, add the following environment variables:

  ADD EnterpriseRootCA.crt /usr/local/share/ca-certificates/
  RUN /usr/sbin/update-ca-certificates
  

• For Python, or other languages relying on the system CA store, on CentOS or Fedora based images, add the following environment variables:

  ADD EnterpriseRootCA.crt /etc/pki/ca-trust/source/anchors/
  RUN /usr/bin/update-ca-trust
  

Avoid unexpected behavior when images change

When your application is restarted or scaled out, the latest image will always be pulled. If the image has been changed, the newly started application instances will use the new image while the old instances will continue to use the old image.

Avoid not being able to connect to the container registry in a VNet

If you deployed the instance to a VNet, make sure you allow the network traffic to your container registry in the NSG or Azure Firewall (if used). For more information, see Customer responsibilities for running in VNet to add the needed security rules.

Install an APM into the image manually

The installation steps vary on different application performance monitors (APMs) and languages. The following steps are for New Relic with Java applications. You must modify the Dockerfile using the following steps:

1. Download and install the agent file into the image by adding the following to the Dockerfile:

   ADD newrelic-agent.jar /opt/agents/newrelic/java/newrelic-agent.jar
   

2. Add the environment variables required by the APM:

   ENV NEW_RELIC_APP_NAME=appName
   ENV NEW_RELIC_LICENSE_KEY=newRelicLicenseKey
   

3. Modify the image entry point by adding: java -javaagent:/opt/agents/newrelic/java/newrelic-agent.jar

To install the agents for other languages, refer to the official documentation for the other agents:

New Relic:

• Python: Install the Python agent
• Node.js: Install the Node.js agent

Dynatrace:

• Python: Instrument Python applications with OpenTelemetry
• Node.js: Instrument Node.js applications with OpenTelemetry

AppDynamics:

• Python: Install the Python Agent
• Node.js: Installing the Node.js Agent

View the container logs

To view the console logs of your container application, the following CLI command can be used:

az spring app logs \
    --resource-group <your-resource-group> \
    --name <your-app-name> \
    --service <your-service-name> \
    --instance <your-instance-name>

To view the container events logs from the Azure Monitor, enter the query:

AppPlatformContainerEventLogs
| where App == "hw-20220317-1b"

Scan your image for vulnerabilities

We recommend that you use Microsoft Defender for Cloud with ACR to prevent your images from being vulnerable. For more information, see Microsoft Defender for Cloud

Switch between JAR deployment and container deployment

You can switch the deployment type from JAR deployment to container deployment directly by redeploying using the following command:

az spring app deploy \
    --resource-group <your-resource-group> \
    --name <your-app-name> \
    --container-image <your-container-image> \
    --service <your-service-name>

Or reversely:

az spring app deploy \
    --resource-group <your-resource-group> \
    --name <your-app-name> \
    --artifact-path <your-jar-file> \
    --service <your-service-name>

Create another deployment with an existing JAR deployment

You can create another deployment using an existing JAR deployment using the following command:

az spring app deployment create \
    --resource-group <your-resource-group> \
    --name <your-deployment-name> \
    --app <your-app-name> \
    --container-image <your-container-image> \
    --service <your-service-name>

CI/CD

Automating deployments using Azure Pipelines Tasks or GitHub Actions are supported now. For more information, see Automate application deployments to Azure Spring Apps and Use Azure Spring Apps CI/CD with GitHub Actions

Next steps

• How to capture dumps