Architecture best practices for Azure Container Apps

Choose appropriate SKU configurations. Select an environment SKU that aligns with the resource and performance requirements of your container apps.

Build redundancy to improve resiliency. For ingress-exposed (HTTP or Transmission Control Protocol (TCP)) apps, use at least three replicas to help ensure availability. To minimize cold starts, configure a minimum number of always-ready replicas.

Use availability zones as part of your resiliency strategy to increase availability when you deploy to a single region. Many Azure regions provide availability zones. The zones are positioned close enough to ensure low-latency connections among them, but far enough apart to minimize the risk of local outages affecting multiple zones.

For critical workloads, deploy Container Apps environments across multiple regions and use Azure Front Door or Azure Traffic Manager for traffic management. These services help ensure high availability and business continuity. If a regional outage occurs, you can automatically redirect traffic to a secondary region to minimize downtime and data loss.

Implement horizontal autoscaling. Configure autoscaling by using scale rules that are based on HTTP requests, TCP connections, or custom metrics, such as CPU and memory thresholds. You can define custom metrics in Azure Service Bus, Azure Event Hubs, Apache Kafka, and Azure Cache for Redis. Use autoscaling to dynamically manage loads and maintain high availability during peak usage times.

Ensure that your container apps can still serve requests within your service-level objective (SLO) under high load.

Monitor reliability and overall health indicators of the container app. Collect logs and metrics to monitor health, identify performance and reliability trends, and troubleshoot problems. For more information about designing the reliability and health monitoring solution for your workload, see Health modeling for workloads.

Implement monitoring tooling and alerts. Activate monitoring tools, like Azure Monitor and OpenTelemetry. Set up alerts to promptly detect and respond to events that affect reliability.

Configure health probes. Set up startup, readiness, and liveness probes for all services to monitor and maintain application health.

Configure self-healing mechanisms to automatically restart unhealthy container instances. Automatic restarts increase the reliability and availability of your applications. They help ensure quick recovery from failures without manual intervention. Use health probes to detect failing containers and configure resiliency policies to automatically handle retries and circuit breakers.

Review security baselines. To enhance the security posture of your workload, review the security baseline for Container Apps.

Integrate with Microsoft Entra ID for identity and access mangement. Use role-based access control (RBAC) with Microsoft Entra ID for least privilege access.

Use managed identities with Microsoft Entra ID for secure, credential-free access to Azure resources.

Implement segmentation and network controls. Deploy private container apps environments and use internal ingress mode for isolation from the public internet.

Control egress traffic. To prevent data exfiltration, integrate your container apps environment into a custom virtual network that has user-defined routes to help secure outbound traffic.

Maintain a hardened workload's software supply chain. Implement container-aware scanning in your secure continuous integration and continuous delivery (CI/CD) pipelines. This feature detects vulnerabilities and helps ensure the integrity of your container images. For more information, see Containers Secure Supply Chain.

Reduce the attack surface. Harden container images and remove unused components. Use lean and minimal base images like Alpine and Chiselled Ubuntu images.

Integrate with Microsoft Defender. Use Microsoft Defender for Containers to scan images in Azure Container Registry.

Encrypt data at rest and data in transit. Use modern industry-standard methods to guard confidentiality and integrity.

Use Azure Key Vault. Store sensitive configuration values and secrets in Key Vault to protect them from unauthorized access.

Enable mutual Transport Layer Security (mTLS). Use mTLS to authenticate and encrypt traffic between services. This feature verifies both parties, which enhances security.

Enforce HTTPS. Configure Envoy proxy to redirect all HTTP traffic to HTTPS. The default configuration for Envoy is allowInsecure: false.

Implement a security monitoring strategy. Capture detailed logs for monitoring and auditing. Send system and console logs to a Log Analytics workspace, Event Hubs, or a non-Microsoft solution for monitoring and auditing purposes. Scrub sensitive data from logs. Console logs originate from the stderr and stdout streams in the app.

Select appropriate pricing plans. Choose the most cost-effective pricing plans for your container apps based on workload requirements and expected usage patterns.

Take advantage of the Azure savings plan for compute by committing to a fixed hourly rate for one or three years. Use a savings plan to save up to 17% compared to pay-as-you-go pricing. Optimize your budget and reduce overall expenses for long-term, predictable workloads.

Optimize workload component costs. Regularly review and adjust CPU and memory allocations to match the needs of your applications. This practice prevents over-provisioning and minimizes costs.

Use managed disk tiers. When you use volume mounts, select appropriate managed disk tiers and sizes to optimize storage costs for persistent data. Only pay for what you need.

Use streamlined and optimized container images to improve startup times and resource efficiency, which reduces storage and network costs.

Optimize scaling costs. Configure autoscaling policies to automatically scale down resources during low-demand periods and scale up during peak times. This practice ensures efficient resource usage.

Optimize networking costs. Optimize network paths to minimize data transfer costs, especially for applications that have high bandwidth volumes.

Use cost management tools. Use Microsoft Cost Management tools to track and analyze spending, set budgets, create cost alerts, and implement consistent tagging across resources.

These tools provide detailed visibility into cloud spending, help identify cost-saving opportunities, ensure adherence to budgetary constraints, and allow for granular tracking and reporting of costs associated with specific workloads, applications, and environments.

Implement an infrastructure as code (IaC) deployment approach. Implement template-based deployments by using tools like Bicep or Terraform. Ensure that all deployments are repeatable, traceable, and stored in a source code repository.

Automate infrastructure and workload deployments. Use standard software solutions to manage, integrate, and automate the deployment of your workloads.

Set up deployment pipelines to redeploy the environment to another region if a regional outage occurs. This approach helps you quickly restore and redeploy critical data and configurations in another region, which enhances disaster recovery capabilities and minimizes downtime during regional failures.

Build automated processes to set up your environments with necessary configurations and deployments by using CI/CD pipelines.

Implement a comprehensive monitoring strategy. Configure diagnostics settings to capture logs, metrics, and diagnostics data. Use tools like Azure Monitor and Application Insights to track application health and performance, identify trends in performance and reliability, and troubleshoot problems.

Emit telemetry for workloads. Design your workloads to emit telemetry data, including liveliness and readiness statuses, to facilitate monitoring and troubleshooting.

Monitor performance metrics. Continuously monitor key performance metrics such as CPU, memory, and network usage to identify opportunities for cost optimization and operational efficiencies.

Implement chaos engineering. Apply chaos engineering practices by using tools such as Azure Chaos Studio to identify potential reliability problems within your Container Apps environment. Conduct experiments to ensure that your applications can withstand unexpected failures. Conduct performance testing by using tools such as Azure Load Testing to make sure scaling rules work as expected without disruptions to clients.

Implement consistent resource tagging across all container apps and other workload resources. Consistent tagging facilitates efficient resource management, cost tracking, and automation.

Enforce workload governance. Azure Policy helps ensure consistent compliance with organizational standards, automates policy enforcement, and provides centralized visibility and control over your workload's resources.

Develop a detailed capacity plan to ensure that your container apps have sufficient resources to handle varying loads while avoiding over-provisioning. A capacity plan helps optimize cost and performance.

Regularly update your plan to document the correct resource allocations, autoscale settings, and failover strategies for your container apps. This approach ensures that you can quickly restore and redeploy critical data and configurations in another region, which enhances disaster recovery capabilities and minimizes downtime during regional failures.

Enable autoscaling. Configure autoscaling policies to automatically adjust the number of container instances based on real-time demand, which ensures optimal performance during peak and off-peak times.

Optimize resource allocation. Continuously monitor and adjust CPU and memory allocations based on performance metrics to ensure efficient resource usage and prevent over-provisioning.

Conduct load testing. Perform regular load testing to evaluate the performance and scalability of your container apps under different conditions. Testing helps ensure that container apps can handle expected traffic levels.

Separate workloads. Deploy critical and sensitive workloads in separate Container Apps environments to avoid noisy neighbor problems. Distribute workloads across multiple environments to ensure that critical applications have dedicated resources. This method also ensures that the performance demands of less-critical applications don't affect critical applications.