Continuous deployment with custom containers in Azure App Service

2. Choose deployment source

Choose the deployment source based on the following criteria:

• Container registry sets up CI/CD between your container registry and App Service.
• Choose the GitHub Actions option if you maintain the source code for your container image in GitHub. New commits to your GitHub repository trigger the deploy action, which can run docker build and docker push directly to your container registry. It then updates your App Service app to run the new image. For more information, see How CI/CD works with GitHub Actions.
• To set up CI/CD with Azure Pipelines, see Deploy an Azure Web App Container from Azure Pipelines.
• For a Docker Compose app, select Container Registry.

If you choose GitHub Actions, select Authorize and follow the authorization prompts. If you previously authorized with GitHub, you can deploy from a different user's repository by selecting Change Account.

After you authorize your Azure account with GitHub, select the Organization, Repository, and Branch to deploy from.

2. Configure registry settings

3. Configure registry settings

To deploy a multi-container (Docker Compose) app, select Docker Compose in Container Type.

If you don't see the Container Type dropdown list, scroll back up to Source and select Container Registry.

3. Enable CI/CD

4. Enable CI/CD

4. Save your settings

5. Save your settings

How CI/CD works with GitHub Actions

If you choose GitHub Actions in Source (see Choose deployment source), App Service sets up CI/CD in the following ways:

• It deposits a GitHub Actions workflow file into your GitHub repository to handle build and deploy tasks to App Service.
• It adds the credentials for your private registry as GitHub secrets. The generated workflow file runs the Azure/docker-login action to sign in with your private registry, and then runs docker push to deploy to it.
• It adds the publishing profile for your app as a GitHub secret. The generated workflow file uses this secret to authenticate with App Service, and then runs the Azure/webapps-deploy action to configure the updated image, which triggers an app restart to pull in the updated image.
• It captures information from the workflow run logs and displays it in the Logs tab in your app's Deployment Center.

You can customize the GitHub Actions build provider in the following ways:

• Customize the workflow file after it generates in your GitHub repository. For more information, see Workflow syntax for GitHub Actions. The workflow must end with the Azure/webapps-deploy action to trigger an app restart.
• If the selected branch is protected, you can still preview the workflow file without saving the configuration. Add it and the required GitHub secrets into your repository manually. This method doesn't give you log integration with the Azure portal.
• Instead of a publishing profile, deploy by using a service principal in Microsoft Entra ID.

Authenticate with a service principal

This optional configuration replaces the default authentication with publishing profiles in the generated workflow file.

Generate a service principal by using the az ad sp create-for-rbac command in the Azure CLI. In the following example, replace <subscription-id>, <group-name>, and <app-name> with your own values. Save the entire JSON output for the next step, including the top-level {}.

az ad sp create-for-rbac --name "myAppDeployAuth" --role contributor \
                            --scopes /subscriptions/<subscription-id>/resourceGroups/<group-name>/providers/Microsoft.Web/sites/<app-name> \
                            --json-auth

In GitHub, go to your repository, and then select Settings > Secrets > Add a new secret. Paste the entire JSON output from the Azure CLI command into the secret's value field. Give the secret a name like AZURE_CREDENTIALS.

In the workflow file generated by the Deployment Center, revise the azure/webapps-deploy step with code similar to the following example:

- name: Sign in to Azure 
# Use the GitHub secret you added
- uses: azure/login@v1
    with:
    creds: ${{ secrets.AZURE_CREDENTIALS }}
- name: Deploy to Azure Web App
# Remove publish-profile
- uses: azure/webapps-deploy@v2
    with:
    app-name: '<app-name>'
    slot-name: 'production'
    images: '<registry-server>/${{ secrets.AzureAppService_ContainerUsername_... }}/<image>:${{ github.sha }}'
    - name: Sign out of Azure
    run: |
    az logout

To configure a multi-container (Docker Compose) app, prepare a Docker Compose file locally, and then run az webapp config container set with the --multicontainer-config-file parameter. If your Docker Compose file contains private images, add --docker-registry-server-* parameters as shown in the previous example.

az webapp config container set --resource-group <group-name> --name <app-name> --multicontainer-config-file <docker-compose-file>