[WIP] Copilot Request

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[containerapp] az containerapp job start --image replaces the requested image with the quickstart image when --registry-identity system is used</issue_title>
<issue_description>Source: Azure/azure-cli#33548 (by @eric15342335)
Affected extension: containerapp (src/containerapp/)

---

<<UNTRUSTED:issue-33548>>

Issue Azure/azure-cli-extensions#33548 (by @eric15342335)

Title

az containerapp job start --image replaces the requested image with the quickstart image when --registry-identity system is used

Body

When starting an existing Azure Container Apps job with both:

''' powershell
--image
--registry-identity system
'''

the execution does not use the image supplied through --image.

Instead, Azure CLI submits the following public quickstart image in the execution template:

''' powershell
mcr.microsoft.com/k8se/quickstart:latest
'''

The existing job is already configured with:

• A system-assigned managed identity
• A private Azure Container Registry
• The registry identity set to system
• The requested private image in the stored job template

Therefore, no identity bootstrap should be required when starting an execution.

Related command

az containerapp job start

Errors

No CLI exception or non-zero exit code is returned.

az containerapp job start completes successfully with exit code 0 and creates an execution. However, inspecting the resulting execution shows that the image supplied through --image was replaced.

The execution was started using:

''' powershell
$execution = az containerapp job start --resource-group "<RESOURCE_GROUP>"
--name "<JOB_NAME>" --image "<ACR_NAME>.azurecr.io/<REPOSITORY>:<TAG>"
--container-name "<CONTAINER_NAME>" --cpu 0.25
--memory 0.5Gi --registry-identity system
--query name `
--output tsv
'''

The resulting execution was inspected using:

''' powershell
az containerapp job execution show --resource-group "<RESOURCE_GROUP>"
--name "<JOB_NAME>" --job-execution-name $execution
--query 'properties.template.containers[].{name:name,image:image,cpu:resources.cpu,memory:resources.memory}' `
--output jsonc
'''

The inspection command returned:

''' json
[
{
"cpu": 0.25,
"image": "mcr.microsoft.com/k8se/quickstart:latest",
"memory": "0.5Gi",
"name": "<CONTAINER_NAME>"
}
]
'''

The command therefore reports success, but the execution uses mcr.microsoft.com/k8se/quickstart:latest instead of the private image explicitly supplied through --image.

Issue script & Debug output

''' powershell
$ErrorActionPreference = "Stop"

$SubscriptionId = "<SUBSCRIPTION_ID>"
$ResourceGroup = "<RESOURCE_GROUP>"
$EnvironmentName = "<CONTAINER_APPS_ENVIRONMENT>"
$AcrName = "<ACR_NAME>"
$WorkloadProfileName = "Consumption"

$Suffix = Get-Date -Format "MMddHHmmss"
$JobName = "cli-job-start-repro-$Suffix"
$ContainerName = "repro"
$Repository = "cli-job-start-repro"
$Tag = $Suffix
$SourceImage = "mcr.microsoft.com/k8se/quickstart-jobs:latest"

$ExecutionName = $null
$JobCreated = $false
$ImageImported = $false

function Assert-AzSuccess {
param([string]$Operation)

if ($LASTEXITCODE -ne 0) {
    throw "$Operation failed with exit code $LASTEXITCODE."
}

}

try {
Write-Host "Selecting the test subscription"

az account set `
  --subscription $SubscriptionId

Assert-AzSuccess "Selecting the subscription"

$LoginServerOutput = az acr show `
  --name $AcrName `
  --query loginServer `
  --output tsv

Assert-AzSuccess "Reading the ACR login server"

$LoginServer = ($LoginServerOutput | Out-String).Trim()
$PrivateImage = "${LoginServer}/${Repository}:${Tag}"

Write-Host "Importing a small test image into the private ACR"

az acr import `
  --name $AcrName `
  --source $SourceImage `
  --image "${Repository}:${Tag}" `
  --force `
  --output none

Assert-AzSuccess "Importing the test image"
$ImageImported = $true

Write-Host "Creating a temporary job on the Consumption workload profile"

az containerapp job create `
  --resource-group $ResourceGroup `
  --name $JobName `
  --environment $EnvironmentName `
  --trigger-type Manual `
  --replica-timeout 300 `
  --replica-retry-limit 0 `
  --replica-completion-count 1 `
  --parallelism 1 `
  --image $PrivateImage `
  --container-name $ContainerName `
  --cpu 0.25 `
  --memory 0.5Gi `
  --workload-profile-name $WorkloadProfileName `
  --mi-system-assigned `
  --registry-server $LoginServer `
  --registry-identity system `
  --output none

Assert-AzSuccess "Creating the temporary job"
$JobCreated = $true

Write-Host ""
Write-Host "Stored job configuration"
Write-Host ""

az containerapp job show `
  --resource-group $ResourceGroup `
  --name $JobName `
  --query '{identityType:identity.type,registries:properties.configuration.registries,workloadProfile:properties.workloadProfileName,containers:properties.template.containers[].{name:name,image:image,cpu:resources.cpu,memory:resources.memory}}' `
  --output jsonc `
  --debug

Assert-AzSuccess "Reading the stored job configuration"

Write-Host ""
Write-Host "Starting the execution with --image and --registry-identity system"
Write-Host ""

$ExecutionOutput = az containerapp job start `
  --resource-group $ResourceGroup `
  --name $JobName `
  --image $PrivateImage `
  --container-name $ContainerName `
  --cpu 0.25 `
  --memory 0.5Gi `
  --registry-identity system `
  --query name `
  --output tsv `
  --debug

Assert-AzSuccess "Starting the job execution"

$ExecutionName = ($ExecutionOutput | Out-String).Trim()

Write-Host ""
Write-Host "Execution name: $ExecutionName"
Write-Host ""
Write-Host "Resulting execution template"
Write-Host ""

az containerapp job execution show `
  --resource-group $ResourceGroup `
  --name $JobName `
  --job-execution-name $ExecutionName `
  --query 'properties.template.containers[].{name:name,image:image,cpu:resources.cpu,memory:resources.memory}' `
  --output jsonc `
  --debug

Assert-AzSuccess "Reading the execution template"

}
finally {
if ($ExecutionName) {
Write-Host ""
Write-Host "Stopping the temporary execution"

    az containerapp job stop `
      --resource-group $ResourceGroup `
      --name $JobName `
      --job-execution-name $ExecutionName `
      --only-show-errors `
      --output none
}

if ($JobCreated) {
    Write-Host "Deleting the temporary job"

    az containerapp job delete `
      --resource-group $ResourceGroup `
      --name $JobName `
      --yes `
      --only-show-errors `
      --output none
}

if ($ImageImported) {
    Write-Host "Deleting the temporary ACR image"

    az acr repository delete `
      --name $AcrName `
      --image "${Repository}:${Tag}" `
      --yes `
      --only-show-errors `
      --output none
}

}
'''

The complete reproduction script above was run with Azure CLI 2.87.0 and the containerapp extension 1.3.0b4.

The existing job was successfully created with the requested private image:

''' json
{
"containers": [
{
"cpu": 0.25,
"image": "<ACR_NAME>.azurecr.io/cli-job-start-repro:",
"memory": "0.5Gi",
"name": "repro"
}
],
"identityType": "SystemAssigned",
"registries": [
{
"identity": "system",
"server": "<ACR_NAME>.azurecr.io"
}
],
"workloadProfile": "Consumption"
}
'''

The following command was then run:

''' powershell
$ExecutionOutput = az containerapp job start --resource-group "<RESOURCE_GROUP>"
--name "<JOB_NAME>" --image "<ACR_NAME>.azurecr.io/cli-job-start-repro:<TAG>"
--container-name "repro" --cpu 0.25
--memory 0.5Gi --registry-identity system
--query name --output tsv
--debug
'''

Relevant sanitized debug output:

''' json
CommandName: containerapp job start
ParameterSetName: --resource-group --name --image --container-name --cpu --memory --registry-identity --query --output --debug

Request URL:
https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/
... [truncated, original was 11917 chars]

Comments

Comment by @yonzhan

Thank you for opening this issue, we will look into it.
<<END:issue-33548>></issue_description>

• Closes [containerapp] az containerapp job start --image replaces the requested image with the quickstart image when --registry-identity system is used #9947

Comments on the Issue (you are @copilot in this section)

@azclibot ## Issue Context

This issue is tracked from Azure/azure-cli#33548.

Problem Summary

The az containerapp job start command with --image and --registry-identity system parameters replaces the specified private ACR image with the public quickstart image mcr.microsoft.com/k8se/quickstart:latest.

Command

az containerapp job start \
  --resource-group "<RESOURCE_GROUP>" \
  --name "<JOB_NAME>" \
  --image "<ACR_NAME>.azurecr.io/<REPOSITORY>:<TAG>" \
  --container-name "<CONTAINER_NAME>" \
  --cpu 0.25 \
  --memory 0.5Gi \
  --registry-identity system

Expected Behavior

The execution should use the image specified via the --image parameter.

Actual Behavior

The execution uses mcr.microsoft.com/k8se/quickstart:latest instead of the specified private image.

Environment

• Azure CLI: 2.87.0
• containerapp extension: 1.3.0b4
• Complete reproduction script provided in the original issue

Investigation Notes

The issue occurs when:

1. An existing job is already configured with system-assigned managed identity
2. A private Azure Container Registry is configured
3. The registry identity is set to system
4. Both --image and --registry-identity system are provided to az containerapp job start

The CLI returns exit code 0 (success) but inspection of the execution shows the wrong image was used.

Please investigate the az containerapp job start command implementation in the containerapp extension to identify why the --image parameter is being overridden when --registry-identity system is specified.

---

Posted by agent-assist (autonomous bug-fix pipeline).</comment_new>

[azure-client-tools-bot-prd]

️✔️Azure CLI Extensions Breaking Change Test

️✔️Non Breaking Changes

[azure-client-tools-bot-prd]

Hi @copilot,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

[yonzhan]

Copilot