Azure Containerregistry Py

Azure Container Registry SDK for Python

管理 Azure 容器注册表中的容器镜像、制品和仓库。

安装

pip install azure-containerregistry

环境变量

AZURE_CONTAINERREGISTRY_ENDPOINT=https://<registry-name>.azurecr.io

身份认证

Entra ID（推荐）

from azure.containerregistry import ContainerRegistryClient
from azure.identity import DefaultAzureCredential

client = ContainerRegistryClient(
    endpoint=os.environ["AZURE_CONTAINERREGISTRY_ENDPOINT"],
    credential=DefaultAzureCredential()
)

匿名访问（公共注册表）

from azure.containerregistry import ContainerRegistryClient

client = ContainerRegistryClient(
    endpoint="https://mcr.microsoft.com",
    credential=None,
    audience="https://mcr.microsoft.com"
)

列出仓库

client = ContainerRegistryClient(endpoint, DefaultAzureCredential())

for repository in client.list_repository_names():
    print(repository)

仓库操作

获取仓库属性

properties = client.get_repository_properties("my-image")
print(f"Created: {properties.created_on}")
print(f"Modified: {properties.last_updated_on}")
print(f"Manifests: {properties.manifest_count}")
print(f"Tags: {properties.tag_count}")

更新仓库属性

from azure.containerregistry import RepositoryProperties

client.update_repository_properties(
    "my-image",
    properties=RepositoryProperties(
        can_delete=False,
        can_write=False
    )
)

删除仓库

client.delete_repository("my-image")

列出标签

for tag in client.list_tag_properties("my-image"):
    print(f"{tag.name}: {tag.created_on}")

按顺序过滤

from azure.containerregistry import ArtifactTagOrder

# 最新优先
for tag in client.list_tag_properties(
    "my-image",
    order_by=ArtifactTagOrder.LAST_UPDATED_ON_DESCENDING
):
    print(f"{tag.name}: {tag.last_updated_on}")

清单操作

列出清单

from azure.containerregistry import ArtifactManifestOrder

for manifest in client.list_manifest_properties(
    "my-image",
    order_by=ArtifactManifestOrder.LAST_UPDATED_ON_DESCENDING
):
    print(f"Digest: {manifest.digest}")
    print(f"Tags: {manifest.tags}")
    print(f"Size: {manifest.size_in_bytes}")

获取清单属性

manifest = client.get_manifest_properties("my-image", "latest")
print(f"Digest: {manifest.digest}")
print(f"Architecture: {manifest.architecture}")
print(f"OS: {manifest.operating_system}")

更新清单属性

from azure.containerregistry import ArtifactManifestProperties

client.update_manifest_properties(
    "my-image",
    "latest",
    properties=ArtifactManifestProperties(
        can_delete=False,
        can_write=False
    )
)

删除清单

# 按摘要删除
client.delete_manifest("my-image", "sha256:abc123...")

# 按标签删除
manifest = client.get_manifest_properties("my-image", "old-tag")
client.delete_manifest("my-image", manifest.digest)

标签操作

获取标签属性

tag = client.get_tag_properties("my-image", "latest")
print(f"Digest: {tag.digest}")
print(f"Created: {tag.created_on}")

删除标签

client.delete_tag("my-image", "old-tag")

上传和下载制品

from azure.containerregistry import ContainerRegistryClient

client = ContainerRegistryClient(endpoint, DefaultAzureCredential())

# 下载清单
manifest = client.download_manifest("my-image", "latest")
print(f"Media type: {manifest.media_type}")
print(f"Digest: {manifest.digest}")

# 下载 Blob
blob = client.download_blob("my-image", "sha256:abc123...")
with open("layer.tar.gz", "wb") as f:
    for chunk in blob:
        f.write(chunk)

异步客户端

from azure.containerregistry.aio import ContainerRegistryClient
from azure.identity.aio import DefaultAzureCredential

async def list_repos():
    credential = DefaultAzureCredential()
    client = ContainerRegistryClient(endpoint, credential)
    
    async for repo in client.list_repository_names():
        print(repo)
    
    await client.close()
    await credential.close()

清理旧镜像

from datetime import datetime, timedelta, timezone

cutoff = datetime.now(timezone.utc) - timedelta(days=30)

for manifest in client.list_manifest_properties("my-image"):
    if manifest.last_updated_on < cutoff and not manifest.tags:
        print(f"Deleting {manifest.digest}")
        client.delete_manifest("my-image", manifest.digest)

客户端操作

最佳实践

1. 使用 Entra ID 进行生产环境身份认证
2. 按摘要删除而非标签，避免产生孤立镜像
3. 锁定生产镜像 设置 can_delete=False
4. 定期清理未标记的清单
5. 使用异步客户端 处理高吞吐量操作
6. 按 last_updated 排序 查找最近/旧的镜像
7. 删除前检查 manifest.tags 避免误删已标记的镜像

适用场景

本技能适用于执行概述中描述的工作流或操作。

限制

• 仅当任务明确符合上述范围时使用本技能。
• 输出内容不应替代环境特定的验证、测试或专家审查。
• 若缺少必要的输入、权限、安全边界或成功标准，请停止并请求澄清。