Build a containerized Python web app in the cloud

This article is part of a tutorial about how to containerize and deploy a Python web app to Azure App Service. App Service enables you to run containerized web apps and deploy through continuous integration/continuous deployment (CI/CD) capabilities with Docker Hub, Azure Container Registry, and Visual Studio Team Services. In this part of the tutorial, you learn how to build the containerized Python web app in the cloud.

In the previous optional part of this tutorial, a container image was build and run locally. In contrast, in this part of the tutorial, you build (containerize) a Python web app into a Docker image directly in Azure Container Registry. Building the image in Azure is typically faster and easier than building locally and then pushing the image to a registry. Also, building in the cloud doesn't require Docker to be running in your dev environment.

Once the Docker image is in Azure Container Registry, it can be deployed to Azure App service.

The service diagram shown below highlights the components covered in this article.

1. Create an Azure Container Registry

If you already have an Azure Container Registry you can use, go to the next step. If you don't, create one.

Azure CLI

Azure CLI commands can be run in the Azure Cloud Shell or on a workstation with the Azure CLI installed. When running in Cloud Shell, skip Step 3.

Step 1. Create a resource group if needed with the az group create command. If you've already set up an Azure Cosmos DB for MongoDB account in part 2. Build and test container locally of this tutorial, set RESOURCE_GROUP_NAME to the name of the resource group you used for that account and move on to Step 2.

RESOURCE_GROUP_NAME='msdocs-web-app-rg'
LOCATION='eastus'

az group create -n $RESOURCE_GROUP_NAME -l $LOCATION

LOCATION should be an Azure location value. Choose a location near you. You can list Azure location values with the following command: az account list-locations -o table.

Step 2. Create a container registry with the az acr create command.

REGISTRY_NAME='<your Azure Container Registry name>'

az acr create -g $RESOURCE_GROUP_NAME -n $REGISTRY_NAME --sku Basic

REGISTRY_NAME must be unique within Azure and contain 5-50 alphanumeric characters.

In the JSON output of the command look for the loginServer value, which is the fully qualified registry name (all lowercase) and which should include the registry name you specified.

Step 3. If you're running the Azure CLI locally, log in to the registry using the az acr login command.

az acr login -n $REGISTRY_NAME

The command adds "azurecr.io" to the name to create the fully qualified registry name. If successful, you'll see the message "Login Succeeded".

Note

The az acr login command isn't needed or supported in Cloud Shell.

VS Code

These steps require the Docker extension for VS Code.

Instructions	Screenshot
Select F1 or CTRL+SHIFT+P to open the command palette. Type "registry". Select the task Azure Container Registry: Create Registry... Alternatively, in the Docker extension REGISTRIES section, right-click your subscription and select Create Registry. This UI action starts the same create registry task.
Select the task and enter values following the prompts, which include: Registry name → The registry name must be unique within Azure, and contain 5-50 alphanumeric characters. SKU → Select Standard. Resource group → Use an existing group or create a new one. Location → If you're using an existing resource group, select the location to match. Otherwise, the location is where the resource group is created that contains the registry.
In the Docker extension, in the REGISTRIES section, find the registry you created, right-click and select View Properties. Look for the loginServer key value pair in the output. The value is the fully qualified name of the registry.

Azure portal

Sign in to the Azure portal and follow these steps to create an Azure Container Registry.

Instructions	Screenshot
Search for "container registries" in the portal search and go to the Container registries service.
Select + Create to start the create process.
Fill out the form and specify: Resource group → Use an existing group or create a new one. Registry name → The registry name must be unique within Azure, and contain 5-50 alphanumeric characters. Location → If you are using an existing resource group, select the location to match. Otherwise, the location is where the resource group is created that contains the registry. SKU → Select Standard. When finished, select Review + create. After the validation is complete, select Create.
After the deployment is complete, go to the new registry and find the fully qualified name. Go to the Overview resource of the registry. Find the Login server. It should be a fully qualified name with "azurecr.io".
The admin account is required to deploy a container image from a registry to Azure Web Apps for Containers. Enable the admin user: Got to the Access Keys resource of the registry. Select Enabled for the Admin User. The registry admin account is needed when you use the Azure portal to deploy a container image as is shown in this tutorial. The admin account is only used during the creation of the App Service. After the App Service is created, managed identity is used to pull images from the registry and the admin account can be disabled.

2. Build an image in Azure Container Registry

You can build the container image directly in Azure in a few ways. First, you can use the Azure Cloud Shell, which builds the image without using your local environment at all. You can also build the container image in Azure from your local environment using VS Code or the Azure CLI. Building the image in the cloud doesn't require Docker to be running in your local environment. If you need to, you can follow the instructions in Clone or download the sample app in part 2 of this tutorial to get the sample Flask or Django web app.

Azure CLI

Azure CLI commands can be run on a workstation with the Azure CLI installed or in Azure Cloud Shell. When running in Cloud Shell, skip Step 1.

Step 1. If you're running the Azure CLI locally, log into registry if you haven't done so already with the az acr login command.

az acr login -n $REGISTRY_NAME

If you're accessing the registry from a subscription different from the one in which the registry was created, use the --suffix switch.

Note

The az acr login command isn't needed or supported in Cloud Shell.

Step 2. Build the image with the az acr build command.

az acr build -r $REGISTRY_NAME -g $RESOURCE_GROUP_NAME -t msdocspythoncontainerwebapp:latest .

In this command:

• The dot (".") at the end of the command indicates the location of the source code to build. If you aren't running this command in the sample app root directory, specify the path to the code.

  Rather than a path to the code in your environment, you can, optionally, specify a path to the sample GitHub repo: https://github.com/Azure-Samples/msdocs-python-django-container-web-app or https://github.com/Azure-Samples/msdocs-python-flask-container-web-app.

• If you leave out the -t (same as --image) option, the command queues a local context build without pushing it to the registry. Building without pushing can be useful to check that the image builds.

Step 3. Confirm the container image was created with the az acr repository list command.

az acr repository list -n $REGISTRY_NAME

VS Code

These steps require the Docker extension for VS Code. VS Code needs to be opened in the working folder of your web app.

Instructions	Screenshot
In the Docker extension, go to REGISTRIES and connect to Azure.
Select F1 or CTRL+SHIFT+P to open the command palette. Type "registry". Select the task Azure Container Registry: Build Image in Azure... If you don't see the task, check that Azure appears under REGISTRIES in the Docker extension. You can also right-click the Dockerfile and select Build Image in Azure... to run the task.
Fill out the information to build the image. Tag image → Use the image name "msdocspythoncontainerwebapp:latest". Registry → Select the registry you created above or one you have access to. Base OS image → Select Linux. Check the OUTPUT window for progress and information on the build. If the get a credentials error, right-click the registry in the REGISTRIES section of the Docker extension and select Refresh.
Confirm the image in the Azure Container Registry. In the Docker extension, in the REGISTRIES section, find the container image created. Confirm the name and tag "latest".

Azure portal

Sign in to the Azure portal to complete these steps.

Step 1. Open Azure Cloud Shell.

Step 2. Use the following az acr build command to build.

az acr build \
  -r <registry-name> \
  -g <resource-group> \
  -t msdocspythoncontainerwebapp:latest \
  <repo-path>

The last argument in the command is the fully qualified path to the repo. Use https://github.com/Azure-Samples/msdocs-python-django-container-web-app.git for the Django sample app and https://github.com/Azure-Samples/msdocs-python-flask-container-web-app.git for the Flask sample app.

The command above is for Bash shell. If you use PowerShell as your shell, change the line continuation character from backslash ("\") to backtick ("`").

Step 3. Confirm the container image was created with the az acr repository list command.

az acr repository list -n <registry-name>

Next step

Deploy web app