Azure Container Registry

Configure Valohai to pull private images from Azure Container Registry (ACR).

Private registries are restricted to organization projects. Personal projects don't have access to private repositories.

Create a service principal

Follow Microsoft's guide: Create and use service principal credentials

Quick steps

1. Create a service principal with read access to your ACR:

az ad sp create-for-rbac \
  --name valohai-acr-reader \
  --role acrpull \
  --scopes /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ContainerRegistry/registries/<registry-name>

1. Save the output:

   • appId (your username)

   • password (your password)

Add credentials to Valohai

1. Navigate to Hi, <n> (top-right menu) → Manage <organization>

2. Go to Registries under organization controls

3. Click Add a new entry

4. Configure:

   • Match pattern: <registry-name>.azurecr.io/*

     • Example: mycompany.azurecr.io/*

     • Or narrow it: mycompany.azurecr.io/ml-images/*

   • Registry type: Docker (username and password authentication)

   • Username: Service principal's appId

   • Password: Service principal's password

5. Save

Use the private image

Reference your ACR image in valohai.yaml:

- step:
    name: train
    image: mycompany.azurecr.io/ml-training:v1.0
    command:
      - python train.py

Valohai handles authentication automatically.