Azure Container Apps

Azure Container Apps sits between Azure Functions (function-level) and AKS (full Kubernetes) — containers with automatic scaling, KEDA for event-driven scale rules (scale on queue depth, HTTP load, etc.), and Dapr integration for service-to-service communication, state management, and pub/sub without code changes. For agents: the REST API deploys container apps, manages revisions (traffic split, rollback), runs batch jobs (Container Apps Jobs), and queries app status. Managed Identity enables passwordless auth to Azure services from containers. Competitive pricing: generous free tier. Confidence is docs-derived.

ARM REST API at management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.App. PUT /containerApps/{name} creates or updates a Container App (request body: Container App resource definition — image, env, scale rules, ingress, dapr). GET /containerApps/{name} retrieves app status and revision info. POST /containerApps/{name}/restart restarts the app. PUT /containerApps/{name}/revisionManagement manages traffic split between revisions. POST /jobs/{name}/start triggers a Container Apps Job run. GET /jobs/{name}/executions retrieves job execution history. Azure CLI: az containerapp create --name --image --resource-group --environment. python-sdk: azure-mgmt-appcontainers client library.

Managed Identity (recommended): assign system-assigned or user-assigned Managed Identity to Container App. Azure SDKs automatically use Managed Identity when running in Container Apps — no credentials stored in code. Alternatively: Service Principal + client secret (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET env vars). ARM API: SigV4-equivalent OAuth2 Bearer token from Azure AD. HTTPS enforced. Container registry auth: Managed Identity for private ACR access (no stored credentials). Dapr mTLS for inter-app communication.

ARM API: async operations (LRO) — PUT returns Azure-AsyncOperation header for polling. Provisioning state: Provisioning → Succeeded/Failed. Revision traffic: blue/green and canary supported via traffic weights. Scale-to-zero: cold start on first request (typically 1-3s for standard images). KEDA scaling: event-driven rules (Azure Service Bus queue depth, HTTP concurrency, etc.) — highly configurable. Container Apps uptime at status.azure.com. Free tier: 180,000 vCPU-seconds + 360,000 GiB-seconds/month. VNET integration for private resource access.

learn.microsoft.com/azure/container-apps is comprehensive — quickstart guides, ARM template reference, KEDA scaling guide, Dapr integration docs, Container Apps Jobs reference, and deployment automation guides. Getting started: Azure free account, az containerapp create — first container deployed in under 10 minutes. azure-mgmt-appcontainers Python client. Terraform provider: azurerm_container_app. Bicep/ARM templates for IaC. Community via Microsoft Q&A and Azure Tech Community. Container Apps is rapidly maturing with regular feature additions.