# Check the registry support boundary before retrying a private ACI image pull

> Will private network reachability make any private registry usable by Azure Container Instances?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-012-check-the-registry-support-boundary-before-retrying-a-private-aci-image-pull/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:44+00:00
- Modified: 2026-09-10T00:31:59+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Will private network reachability make any private registry usable by Azure Container Instances?

## Potentially affected

Apply this diagnosis to an Azure Container Instances image pull from a registry with no public IP. Separate this architecture restriction from a misspelled image name, missing artifact or an unrelated runtime problem.

## DSE recommendation

Confirm the registry type before expanding network access or repeating deployment.

## Article

## Source facts

Microsoft says ACI supports image pulls from registries without a public IP only through Azure Container Registry with a private endpoint and managed identity. Non-ACR private registries remain unsupported even when network connectivity exists. An unsuccessful image pull is retried before deployment eventually fails, and the container group’s events expose pull and failure information. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-troubleshooting).

## Applicability

Apply this diagnosis to an Azure Container Instances image pull from a registry with no public IP. Separate this architecture restriction from a misspelled image name, missing artifact or an unrelated runtime problem.

## DSE recommendation

Confirm the registry type before expanding network access or repeating deployment. Record the registry endpoint, intended image identity and the supported authentication arrangement. If the design uses a non-ACR private registry, raise the unsupported architecture with the application owner and plan an approved image-publication route. Do not expose a private registry publicly just to test whether the deployment succeeds. Keep any registry migration separate from the immediate failure investigation.

## Verification

Inspect the failed group’s pull events and correlate them with the intended registry and image. In an authorized pilot of the supported ACR design, confirm that the expected artifact is obtained through the approved private endpoint and identity. Retain deployment and registry evidence together. A successful reachability probe should not be reported as proof that ACI supports the selected private-registry architecture.

## Official references

[Microsoft Learn: Troubleshoot common issues](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-troubleshooting).

## Primary reference

- Name: Troubleshoot common issues - Azure Container Instances | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-troubleshooting
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the registry support boundary before retrying a private ACI image pull,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-012-check-the-registry-support-boundary-before-retrying-a-private-aci-image-pull/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.