You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-instances/big-containers.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: tomvcassidy
6
6
ms.service: azure-container-instances
7
7
services: container-instances
8
8
ms.topic: concept-article
9
-
ms.date: 03/27/2025
9
+
ms.date: 11/17/2025
10
10
# Customer intent: As a cloud developer, I want to deploy high-performance container workloads with increased vCPU and memory on Azure Container Instances, so that I can efficiently handle data-intensive applications and scale resources seamlessly according to business demands.
Copy file name to clipboardExpand all lines: articles/container-instances/confidential-containers-attestation-concepts.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: tomcassidy
6
6
author: tomcassidy
7
7
ms.service: azure-container-instances
8
8
services: container-instances
9
-
ms.date: 08/29/2024
9
+
ms.date: 11/17/2025
10
10
# Customer intent: As a cloud developer, I want to implement attestation in my confidential container groups on Azure Container Instances, so that I can ensure they run on trusted hardware and comply with security policies essential for safeguarding sensitive data.
# Customer intent: As a cloud architect, I want to manage multiple container group instances using a single API call through NGroups, so that I can streamline operations, enhance scalability, and improve the availability of my cloud applications.
12
12
---
13
13
@@ -47,14 +47,14 @@ NGroups references this Container Group Profile and then calls ACI APIs in order
47
47
48
48
### Container Group Profile (CG Profile)
49
49
50
-
A large-scale cloud application may require you to manage multiple container groups. As of today, in order to run multiple CGs (Container Groups), customers need to provide relevant properties such as container images, restart policy, and other properties each time. This can result in throttling, duplicated effort, and management overhead.
50
+
A large-scale cloud application may require you to manage multiple container groups. As of today, in order to run multiple CGs (Container Groups), customers need to provide relevant properties such as container images, restart policy, and other properties each time. This requirement can result in throttling, duplicated effort, and management overhead.
51
51
52
52
To alleviate this concern, NGroups introduced Container Group Profiles. The container group profile (CGProfile) serves as a *template* for creating container groups with same set of properties.
53
53
54
54
Here are some of the common properties that can be specified in a container group profile:
55
55
56
56
- osType (Example: Linux, Windows)
57
-
- containers. Image name, memory, CPU etc.
57
+
- containers. Image name, memory, CPU, etc.
58
58
- restartPolicy
59
59
- ipAddress protocol and internal port
60
60
- shutdownGracePeriod
@@ -106,10 +106,10 @@ And here's a sample CG profile:
106
106
107
107
### NGroups
108
108
109
-
NGroups resource provides a way to create and manage ‘n’ container groups with a rich set of operations. An NGroups resource references a container group profile resource and uses that to create N instances of similar looking CGs. Within NGroups resource, customers can also specify other properties including but not limited to number of CGs, update preferences (manual or rolling update), load balancers, subnets, and other relevant properties which they want to associate with CGs under an NGroups resource.
109
+
NGroups resource provides a way to create and manage ‘n’ container groups with a rich set of operations. An NGroups resource references a container group profile resource and uses that to create N instances of similar looking CGs. Within NGroups resource, customers can also specify other properties including but not limited to number of CGs, update preferences (manual or rolling update), load balancers, subnets, and other relevant properties they want to associate with CGs under an NGroups resource.
110
110
111
111
> [!NOTE]
112
-
> A CG profile needs to be created **before** creating an NGroups resource. Since the CG profile is an ARM resource, it has its own ARM APIs. A CG profile needs to be created **before** creating an NGroups resource.
112
+
> A CG profile needs to be created **before** creating an NGroups resource. Since the CG profile is an Azure Resource Manager (ARM) resource, it has its own Azure Resource Manager APIs. A CG profile needs to be created **before** creating an NGroups resource.
113
113
114
114
#### Benefits of Referencing Container Group Profile
115
115
@@ -154,7 +154,7 @@ NGroups references a CG profile and adds other related properties and capabiliti
154
154
- The subnet into which CGs are deployed when using a virtual network
155
155
- The Load Balancer or Application Gateway to provide network ingress to the CGs
156
156
157
-
NGroups in turn invokes the ACI ARM APIs to create and manage each CG. Since it uses the same ARM APIs, there's no difference between the CGs created by NGroups and the CGs created directly by the customer. They have the exact same API experience.
157
+
NGroups in turn invokes the ACI Azure Resource Manager APIs to create and manage each CG. Since it uses the same Azure Resource Manager APIs, there's no difference between the CGs created by NGroups and the CGs created directly by the customer. They have the exact same API experience.
158
158
159
159
### Updating an NGroups Resource
160
160
@@ -172,7 +172,7 @@ To update existing CGs with new CGProfile, we issue a *manual update* command wi
172
172
173
173
This mode gives us flexibility to update CGs selectively and provides full control over impact on production workloads.
174
174
175
-
In **Rolling** mode, when we update the reference to cgprofile2 and issue an UPDATE NGroups command, existing CGs are updated with cgprofile2. The update to existing CGs happens in small batches (and not all at once). This ensures that there is a minimal impact on your workload since only a small percentage of CGs may be unavailable during the update.
175
+
In **Rolling** mode, when we update the reference to cgprofile2 and issue an UPDATE NGroups command, existing CGs are updated with cgprofile2. The update to existing CGs happens in small batches (and not all at once). This ensures that there's a minimal impact on your workload since only a small percentage of CGs may be unavailable during the update.
176
176
177
177
We can configure the batch size and other related rolling update mode settings with the NGroups API.
178
178
@@ -199,9 +199,9 @@ If these prerequisites aren't met, requests fail, and the NGroups resource type
Create Zonal NGroups with CGProfile: [NGroups-Zonal-Sample.json](#ngroups-with-zones-sample)
201
201
202
-
Customers can see if a container group is associated to an NGroups resource by checking container group orchestratorId property under the JSON view. The orchestratorId represents the associated NGroups ARM resource ID.
202
+
Customers can see if a container group is associated to an NGroups resource by checking container group orchestratorId property under the JSON view. The orchestratorId represents the associated NGroups Azure Resource Manager resource ID.
203
203
204
-
:::image type="content" source="../media/container-instances-ngroups/cg-arm-json-structure.png" alt-text="A screenshot of an NGroups CG ARM JSON displaying OrchestratorId property.":::
204
+
:::image type="content" source="../media/container-instances-ngroups/cg-arm-json-structure.png" alt-text="A screenshot of an NGroups CG Azure Resource Manager JSON displaying OrchestratorId property.":::
205
205
206
206
## How-To Guide
207
207
@@ -284,7 +284,7 @@ While creating or updating container groups, NGroups relies on the same ACI APIs
284
284
285
285
- Once an NGroups resource is created with a set of zones (for example, { “1”, “2” }), the zones can't be removed. However, a new zone can be added to the list. For example, { “1”, “2”, “3” }
286
286
287
-
- If a specified zone is down, then the overall NGroups operation to create the CGs fails. Retry the request once the zone is back up. Another option is to delete the failed CGs.
287
+
- If a specified zone is down, then the overall NGroups operation to create the CGs fails. Retry the request once the zone is operational again. Another option is to delete the failed CGs.
288
288
289
289
- During scale down, NGroups randomly deletes instances, which might not always maintain AZ spread. However, subsequent scale-out operations always try to rebalance the AZ spread.
290
290
@@ -326,15 +326,15 @@ This can be useful when you have multiple NGroups in a single resource group and
326
326
327
327
Yes, you can set the properties.elasticProfile.maintainDesiredCount bool property to true.
328
328
329
-
It creates a new CG for every CG that is being deleted/detached from the NGroups. It tries to maintain the desiredCount property of the NGroups to its set value.
329
+
It creates a new CG for every CG that's being deleted/detached from the NGroups. It tries to maintain the desiredCount property of the NGroups at its set value.
330
330
331
-
This is useful when you want to use the NGroups as a *pool* which automatically gets replenished when you take away CGs from the pool for your workload scenarios.
331
+
This is useful when you want to use the NGroups as a *pool*, which automatically gets replenished when you take away CGs from the pool for your workload scenarios.
332
332
333
-
It is a nullable bool property. If you omit it for subsequent NGroups PUT/update calls, it doesn't reset to false. To reset, you must explicitly set it to false. When it is null/false, and when a CG is deleted/detached from the NGroups, the desiredCount property for the NGroups reduces accordingly.
333
+
It's a nullable bool property. If you omit it for subsequent NGroups PUT/update calls, it doesn't reset to false. To reset, you must explicitly set it to false. When it's null/false, and when a CG is deleted/detached from the NGroups, the desiredCount property for the NGroups reduces accordingly.
334
334
335
335
#### How do I get the CG name, NGroups ID and other metadata propagated down into the container?
336
336
337
-
Currently, we expose only the CG name and orchestrator ID (the ARM resource ID). In the future, other relevant properties could be considered. These two properties show up as container environment variables.
337
+
Currently, we expose only the CG name and orchestrator ID (the Azure Resource Manager resource ID). In the future, other relevant properties could be considered. These two properties show up as container environment variables.
338
338
339
339
To get these environment variables on the container, specify these tags *at the NGroups level*:
340
340
@@ -358,7 +358,7 @@ For workloads that offer higher availability (for example, NGroups spread across
358
358
359
359
This update is done AZ by AZ with not much automated coordination across AZs. Coordination is manually tracked and best-effort.
360
360
361
-
So, if by chance, a platform update happens simultaneously across 2 or more AZs, then CGs across these AZs can be down simultaneously thus causing unavailability for your NGroups.
361
+
So, if by chance, a platform update happens simultaneously across two or more AZs, then CGs across these AZs can be down simultaneously thus causing unavailability for your NGroups.
362
362
363
363
#### How to use Confidential Containers with NGroups
364
364
@@ -538,7 +538,7 @@ Refer to the ACI documentation of confidential containers here: [Tutorial: Prepa
# Customer intent: As a cloud administrator, I want to perform rolling updates on container groups in NGroups, so that I can ensure minimal workload disruption and maintain service availability during updates.
12
12
---
13
13
@@ -57,11 +57,11 @@ NGroups then automatically group instances into batches and updates one batch at
57
57
58
58
- An **in-place** update invokes a CG PUT call to update each CG of the batch.
59
59
60
-
- A **replace** update invokes a CG PUT call to create new CGs and delete existing CGs of the batch. There exists a 1:1 correspondence between the CGs being created and the CGs being deleted. However, the CG names will be different.
60
+
- A **replace** update invokes a CG PUT call to create new CGs and delete existing CGs of the batch. There exists a 1:1 correspondence between the CGs being created and the CGs being deleted. However, the CG names are different.
61
61
62
-
If a sufficient number of CGs in the batch provide healthy signals after the pauseTimeBetweenBatches period, NGroups automatically starts the next batch for the update. Otherwise, it stops the rollout. The *maxUnhealthyPercent* parameter specifies the total number of unhealthy CGs, while the *maxUnhealthyUpdatedPercent* parameter specifies the total number of unhealthy CGs after the update.
62
+
If a sufficient number of container groups in the batch provide healthy signals after the pauseTimeBetweenBatches period, NGroups automatically starts the next batch for the update. Otherwise, it stops the rollout. The *maxUnhealthyPercent* parameter specifies the total number of unhealthy CGs, while the *maxUnhealthyUpdatedPercent* parameter specifies the total number of unhealthy CGs after the update.
63
63
64
-
Here is an example to issue a rolling update request to NGroups:
64
+
Here's an example to issue a rolling update request to NGroups:
65
65
66
66
```json
67
67
{
@@ -108,7 +108,7 @@ Here is an example to issue a rolling update request to NGroups:
108
108
}
109
109
```
110
110
111
-
If image version is set to the **latest** tag for container images within the CG profile, then NGroups automatically picks up the latest image version during the RU. To prevent unexpected behavior in your application, it is recommended to not use the *latest* tag for images. Instead, use specific versions.
111
+
If image version is set to the **latest** tag for container images within the CG profile, then NGroups automatically picks up the latest image version during the RU. To prevent unexpected behavior in your application, it's recommended to not use the *latest* tag for images. Instead, use specific versions.
112
112
113
113
114
114
> [!NOTE]
@@ -131,17 +131,17 @@ This returns a response containing relevant information about the RU.
131
131
132
132
### Canceling a Rolling Update
133
133
134
-
To cancel a rolling update, use the following API. Once canceled, the RU cannot be resumed/restarted. A new RU needs to be triggered.
134
+
To cancel a rolling update, use the following API. Once canceled, the RU can't be resumed/restarted. A new RU needs to be triggered.
You do not need to provide a request body when calling this API.
138
+
You don't need to provide a request body when calling this API.
139
139
140
-
It's also important to know that canceling an RU won't automatically roll it back to the previous state, but it will remain in the state that it was at the moment it was canceled. For example, in case during an RU one wants to update a CG profile reference from *cgprofile1* to *cgprofile2*, and at some point the operation is canceled, some CGs might have the new profile *cgprofile2* and others remain with *cgprofile1*.
140
+
It's also important to know that canceling an RU won't automatically roll it back to the previous state, but it remains in the state that it was at the moment it was canceled. For example, in case during an RU one wants to update a CG profile reference from *cgprofile1* to *cgprofile2*, and at some point the operation is canceled, some CGs might have the new profile *cgprofile2* and others remain with *cgprofile1*.
141
141
142
142
### Boundary of a Batch in a Rolling Update
143
143
144
-
The CGs of a specific batch in an RU do not cross a fault model boundary. A fault model represents a zone/fault-domain (FD) combination. For example, zone 1 / FD 0 is a fault model boundary, zone 1 / FD 1 is another fault model boundary, and zone 2 / FD 0 is yet another fault model boundary.
144
+
The CGs of a specific batch in an RU don't cross a fault model boundary. A fault model represents a zone/fault-domain (FD) combination. For example, zone 1 / FD 0 is a fault model boundary, zone 1 / FD 1 is another fault model boundary, and zone 2 / FD 0 is yet another fault model boundary.
145
145
146
146
If a customer has a multi-zonal NGroups set up with three zones, a batch is confined to CGs belonging to only one zone at most. A batch never consists of CGs spread across multiple zones.
147
147
@@ -151,7 +151,7 @@ NGroups maintains this fault model boundary in a batch, even when the number of
151
151
152
152
The only time a fault model boundary is crossed when the RU selects unhealthy CGs for the first batch. In this batch, the RU attempts to update all unhealthy CGs to improve the overall availability of NGroups. As a result, when updating unhealthy CGs, the RU may exceed the maxBatchPercent setting.
# Customer intent: "As a cloud architect, I want to configure a static public IP address for a container group using an application gateway, so that I can ensure stable external access to my containerized web applications."
Copy file name to clipboardExpand all lines: articles/container-instances/container-instances-best-practices-and-considerations.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: tomcassidy
6
6
author: tomvcassidy
7
7
ms.service: azure-container-instances
8
8
services: container-instances
9
-
ms.date: 08/29/2024
9
+
ms.date: 11/17/2025
10
10
# Customer intent: As a cloud administrator, I want to implement best practices for deploying workloads on container instances, so that I can ensure security, efficiency, and scalability in my containerized applications.
Copy file name to clipboardExpand all lines: articles/container-instances/container-instances-confidential-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: tomcassidy
6
6
author: tomvcassidy
7
7
ms.service: azure-container-instances
8
8
services: container-instances
9
-
ms.date: 08/29/2024
9
+
ms.date: 11/17/2025
10
10
ms.custom: mvc
11
11
# Customer intent: "As a cloud operator, I want to implement confidential containers on Azure Container Instances, so that I can securely run containerized applications while protecting sensitive data through hardware-based execution environments and verifiable attestation."
# Customer intent: As a container orchestrator user, I want to implement config maps in Azure Container Instances so that I can modify container configurations dynamically without restarting the instances to ensure high availability and minimize downtime.
13
13
---
14
14
# Config maps for Azure Container Instances
15
15
16
-
A config map is a property that you can use to apply container configurations similar to environment variables and secret volumes. However, the process is unlike using environment variables or secret volumes where you must restart the pod to apply the settings. Using a config map to apply settings doesn't require any restarts for the changes to take effect.
16
+
A config map is a property that you can use to apply container configurations similar to environment variables and secret volumes. The process is unlike using environment variables or secret volumes where you must restart the pod to apply the settings. Using a config map to apply settings doesn't require any restarts for the changes to take effect.
17
17
18
-
You can use Azure Container Instances to create container instances with or without config maps. You can also update them at any point after creation by using config maps. Updating config maps in an existing running container group is a task you can accomplish quickly without compromising uptime of the container.
18
+
You can use Azure Container Instances to create container instances with or without config maps. You can also update them at any point after creation by using config maps. Updating config maps in an existing running container group is a task that you can accomplish quickly without compromising uptime of the container.
0 commit comments