Azure Container Registry Enumeration

Login

Using EntraID

az acr login -n $ACR_NAME

Using admin user

az acr update -n $ACR_NAME --admin-enable

docker login -u $ACR_NAME -p <password> <login_server>

az acr login -n containerInstancesLab3ba59b400 --expose-token

docker login containerinstanceslab3ba59b400.azurecr.io \
  -u 00000000-0000-0000-0000-000000000000 \
  -p '<refreshToken>'

Generate a token

az acr token create \
	--registry <container_name>
	--name token
	--scope-map _repositories_admin

docker login <login_server>.azurecr.io -u token -p <password>

### Enable anonymous pull

az acr update --name $ACR_NAME --anonymous-pull-enabled true

List of all the registries

Check the network, managed identities, adminUserEnabled, softDeletePolicy, url…

az acr list

az acr list --query "[].{Name:name,loginServer:loginServer, AdminUser:adminUserEnabled, PublicAccess:publicNetworkAccess, AnonPull:anonymousPullEnabled, SKU:sku.tier, TrustPolicy:policies.trustPolicy.status, Encryption:encryption.status, resourceGroup:resourceGroup}" --output table

List tokens of a registry

az acr token list --registry $ACR_NAME --resource-group $RESOURCE_GROUP

List repositories in a registry

az acr repository list --name $ACR_NAME --resource-group $RESOURCE_GROUP

List the tags of a repository

az acr repository show-tags --repository <repository-name> --name $ACR_NAME

List deleted repository tags

az acr repository list-deleted --name $ACR_NAME

List tasks

Check the git URL or the command

az acr task list --registry $ACR_NAME 

az acr task list --output table \
  --query "[].{Name:name, Identity:identity.type, Source:step.contextPath, Schedule:trigger.timerTriggers[0].schedule, Status:status, imageName:step.imageNames}"  \
   --registry $ACR_NAME

List tasks runs

az acr task list-runs --registry $ACR_NAME

List connected registries

az acr connected-registry list --registry $ACR_NAME

List cache

az acr cache list --registry $ACR_NAME 
az acr cache show -r $ACR_NAME  -n <rule-name>

Allow anonymous pull access

az acr update --name $ACR_NAME  --anonymous-pull-enabled true