防止覆盖 Azure 容器注册表中的 Docker 映像标记

Question

I have seen in the official docs that Docker images can be locked so that they cannot be deleted. Is it also possible to freeze a tag so that this tag can no more be overwriten to point to a different image?

My usecase is that I want to make sure that eg an image with tag 1.2.0 always points to exactly the same image for all times. The tags 1.2 and 1 may be moved but this "semvar" tag shall be stable.

Thank you

Answer 1

Unfortunately, the Azure lock cannot apply to the image tags. Here is the description for the level that it can apply to:

Resource Manager locks apply only to operations that happen in the management plane, which consists of operations sent to https://management.azure.com .

You can use the Azure role-based access control to restrict whether the user can push or pull images. But in this way, the limit will only implement on the repository, not deeper into the tag.