Skip to content
VeraDocs
Back to main site

Azure Container Registry

Create registries, upload and download blobs and image manifests over the registry API, and manage task records.

Plan: Pro112 of 112 operations implemented across 3 APIs7Known differences

Docker CLI login, push and pull weren't tried. In Vera 1.2.0 preview, a task's container step failed because no container execution engine was available.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Section titled “Connect”

Start Vera as in Get started, with your license key activated and the emulator started by the Vera launcher (Activate Pro). Then open Bash in a terminal of its own (on macOS, whose terminal starts zsh, type bash first), go to an empty scratch directory and run this; it needs curl and Python 3. It fetches the emulator's own certificate, so every request checks TLS, and defines arm, which this page's commands use. The bearer token vera-local is a dummy local credential, not your license key.

Terminal window
export VERA_CA_CERT="$PWD/vera-ca.pem"
curl --fail --silent --show-error --noproxy '*' --insecure \
  https://localhost:8543/_vera/ca.pem --output "$VERA_CA_CERT"
curl --fail --silent --show-error --noproxy '*' \
  --cacert "$VERA_CA_CERT" https://localhost:8543/_vera/health; echo


export AZ_BASE='https://localhost:8543'
export SUB='00000000-0000-0000-0000-000000000001'
export TENANT='00000000-0000-0000-0000-0000000000a1'
export TOKEN='vera-local'


62 more lines: show the full setup
# arm METHOD /path API_VERSION [body.json]
# Prints the response body once any operation it started has finished, or,
# if that response had no body, the finished operation's response, such as
# a RunCommand result. A finished operation can hold a failed result: read it.
arm() (
  set -eu
  method=$1; path=$2; version=$3
  work=$(mktemp -d)
  trap 'rm -rf "$work"' EXIT
  case "$path" in /*) ;; *) printf 'Expected a relative /path\n' >&2; exit 1;; esac
  case "$AZ_BASE" in https://localhost:8543|https://127.0.0.1:8543) ;; *) printf 'This recipe requires the local emulator\n' >&2; exit 1;; esac
  args=(--fail-with-body --silent --show-error --noproxy '*' --max-time 20
        --cacert "$VERA_CA_CERT" -H "Authorization: Bearer $TOKEN"
        -H 'Content-Type: application/json')
  body=()
  if [ "$#" -ge 4 ]; then body=(--data-binary "@$4"); fi
  code=$(curl "${args[@]}" -X "$method" ${body[@]+"${body[@]}"} -D "$work/headers" \
    -o "$work/body" -w '%{http_code}' "$AZ_BASE$path?api-version=$version") || {
      cat "$work/body" >&2; exit 1;
    }
  poll_url=$(python3 - "$work/headers" "$AZ_BASE" <<'PY'
import sys,urllib.parse
headers={}
for line in open(sys.argv[1]):
    if ':' in line:
        key,value=line.split(':',1); headers[key.lower()]=value.strip()
url=headers.get('azure-asyncoperation') or headers.get('operation-location') or headers.get('location') or ''
if url:
    url=urllib.parse.urljoin(sys.argv[2],url); p=urllib.parse.urlsplit(url)
    if p.scheme!='https' or p.hostname not in ('localhost','127.0.0.1') or p.port!=8543:
        raise SystemExit('Refusing a non-local operation URL')
print(url)
PY
  ) || exit 1
  if [ -n "$poll_url" ] && [ "$method" != GET ] && [ "$method" != HEAD ]; then
    done_ok=false
    for attempt in $(seq 1 30); do
      code=$(curl "${args[@]}" -D "$work/poll-headers" -o "$work/poll-body" -w '%{http_code}' "$poll_url") || {
        cat "$work/poll-body" >&2; exit 1;
      }
      state=$(python3 - "$work/poll-body" "$code" <<'PY'
import sys,json
raw=open(sys.argv[1]).read(); code=int(sys.argv[2]); value=json.loads(raw) if raw.strip() else {}
status=str(value.get('status') or value.get('properties',{}).get('provisioningState') or '').lower()
if status in ('failed','canceled','cancelled') or value.get('error'):
    print(raw,file=sys.stderr);raise SystemExit('Operation failed')
if status in ('succeeded','completed') or (not status and code in (200,204)):
    print('done')
else: print('pending')
PY
      ) || exit 1
      if [ "$state" = done ]; then done_ok=true; break; fi
      sleep 1
    done
    if [ "$done_ok" != true ]; then printf 'Operation polling timed out\n' >&2; exit 1; fi
    if [ -s "$work/poll-body" ] && ! grep -q '[^[:space:]]' "$work/body" 2>/dev/null; then
      cp "$work/poll-body" "$work/body"
    fi
  fi
  cat "$work/body"
  printf '\n'
)

The health check answers {"cloud": "azure", "generation_status": "generated", "status": "ok"}. Requests go only to the emulator at https://localhost:8543: the helper refuses any other address, including the Azure-looking URLs some responses hold. When you've finished, close the terminal and delete the scratch directory; that removes only these local files, not what you created in the emulator.

The example uses the registry management API (Microsoft.ContainerRegistry) at 2025-11-01 and the registry’s data API at 2021-07-01 for its /acr/v1/ routes, the versions tested with this build, and 2025-04-01 for the resource group. The Docker Registry /v2/ routes take no api-version. Tasks were tested in Vera 1.2.0 preview, with the tasks API at 2025-03-01-preview. The example also needs jq.

Each registry has a data hostname of its own on the emulator, <registry>.azurecr.localhost:8543. The example’s reg function connects that name to 127.0.0.1 with curl’s --resolve, so it needn’t resolve on your machine, checks TLS with the emulator’s certificate, and authenticates with the admin credentials the emulator generates for the registry.

Example

Section titled “Example”

Create a resource group and a Basic registry with its admin user enabled, read it back, and keep its admin credentials for the registry requests:

Terminal window
RG="docs-azure-container-registry"
RGID="/subscriptions/$SUB/resourceGroups/$RG"
cat > resource-group.json <<'JSON'
{"location":"eastus"}
JSON
arm PUT "$RGID" 2025-04-01 resource-group.json
REGISTRY_ID="$RGID/providers/Microsoft.ContainerRegistry/registries/docsregistry"
cat > registry.json <<'JSON'
{"location":"eastus","sku":{"name":"Basic"},"properties":{"adminUserEnabled":true}}
JSON
arm PUT "$REGISTRY_ID" 2025-11-01 registry.json
arm GET "$REGISTRY_ID" 2025-11-01
arm POST "$REGISTRY_ID/listCredentials" 2025-11-01 > registry-credentials.json
REG_USER=$(jq -r '.username' registry-credentials.json)
REG_PASSWORD=$(jq -r '.passwords[0].value' registry-credentials.json)

Creating the registry and listing its credentials each answer 200. Selected fields from the registry’s read:

Output (selected fields)
{
  "sku": { "name": "Basic" },
  "properties": { "adminUserEnabled": true }
}

Define reg, which sends a request to the registry’s data hostname on the emulator, and check that the registry speaks the Docker Registry API. The check answers 200:

Terminal window
REG_HOST='docsregistry.azurecr.localhost'
REG_URL="https://$REG_HOST:8543"
reg() {
  curl --fail-with-body --silent --show-error --noproxy '*' --max-time 20 \
    --cacert "$VERA_CA_CERT" --resolve "$REG_HOST:8543:127.0.0.1" \
    --user "$REG_USER:$REG_PASSWORD" "$@"
}
reg "$REG_URL/v2/"

Upload a small image config as a blob to a repository named docs, download it and compare the bytes. Starting the upload answers 202 with the upload’s address in Location, completing it with the blob’s digest answers 201, and cmp prints nothing because the download matches:

Terminal window
printf '%s' '{"architecture":"amd64","os":"linux","rootfs":{"type":"layers","diff_ids":[]},"config":{}}' > config.json
DIGEST="sha256:$(python3 -c 'import hashlib; print(hashlib.sha256(open("config.json","rb").read()).hexdigest())')"
reg -X POST -D upload.headers -o /dev/null "$REG_URL/v2/docs/blobs/uploads/"
UPLOAD_URL=$(python3 - "$REG_URL" <<'PY'
import sys,urllib.parse
headers={}
for line in open('upload.headers'):
    if ':' in line:
        k,v=line.split(':',1); headers[k.lower()]=v.strip()
url=urllib.parse.urljoin(sys.argv[1],headers['location'])
if not url.startswith(sys.argv[1]+'/'):
    raise SystemExit('Refusing an unexpected upload host')
print(url)
PY
)
case "$UPLOAD_URL" in *\?*) SEP='&';; *) SEP='?';; esac
reg -X PUT -H 'Content-Type: application/octet-stream' --data-binary @config.json \
  "$UPLOAD_URL${SEP}digest=$DIGEST"
reg "$REG_URL/v2/docs/blobs/$DIGEST" > config.downloaded.json
cmp config.json config.downloaded.json

Put a Docker image manifest with that config and no layers, tagged v1, and read it back:

Terminal window
python3 - "$DIGEST" <<'PY'
import sys,json,pathlib
blob=pathlib.Path('config.json').read_bytes()
manifest={'schemaVersion':2,'mediaType':'application/vnd.docker.distribution.manifest.v2+json',
          'config':{'mediaType':'application/vnd.docker.container.image.v1+json','size':len(blob),'digest':sys.argv[1]},'layers':[]}
pathlib.Path('manifest.json').write_text(json.dumps(manifest,separators=(',',':')))
PY
reg -X PUT -H 'Content-Type: application/vnd.docker.distribution.manifest.v2+json' \
  --data-binary @manifest.json "$REG_URL/v2/docs/manifests/v1"
reg -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
  "$REG_URL/v2/docs/manifests/v1"

The put answers 201 and the read 200, with the manifest you put. Formatted, it’s this; the config is always the same 90 bytes, so its digest is too:

Output
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "size": 90,
    "digest": "sha256:7a19147749ce097f32b13072bccba494b5e717d4f23fbde50f7514059e109ad1"
  },
  "layers": []
}

List the registry’s repositories and the docs repository’s tags through the registry’s data API. Both answer 200:

Terminal window
reg "$REG_URL/acr/v1/_catalog?api-version=2021-07-01"
reg "$REG_URL/acr/v1/docs/_tags?api-version=2021-07-01"

To clean up, delete the repository and the registry, then forget the credentials and delete the file that held them:

Terminal window
reg -X DELETE "$REG_URL/acr/v1/docs?api-version=2021-07-01"
arm DELETE "$REGISTRY_ID" 2025-11-01
unset REG_USER REG_PASSWORD
rm -f registry-credentials.json

Deleting the repository answers 202. Deleting the registry answers 202, and its operation finishes with an empty 200. The resource group docs-azure-container-registry stays, since deleting a resource group fails in Vera 1.2.2; a fresh emulator starts without it.

Supported features

Section titled “Supported features”
  • Registries: create a Basic registry with the admin user enabled, read it, list its generated admin credentials and delete it.
  • Blobs over the Docker Registry API: start an upload, complete it with the blob’s digest in one request, and download the same bytes.
  • Image manifests: put and get a Docker schema 2 image manifest that references an uploaded config blob.
  • Repository and tag listings through the registry’s /acr/v1/ data API, and deleting a repository.
  • Task records. In a separate check in Vera 1.2.0 preview, a task with an encoded step was created, read and deleted with the tasks API at 2025-03-01-preview. scheduleRun with a TaskRunRequest that names the task’s taskId queued a run whose status could be read. A request that named only the task (taskName) answered 400 InvalidRequestContent, runRequest.taskId is required.

Limitations

Section titled “Limitations”

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

  • Task steps didn’t run. The tested task had one step: the command /bin/false in the image example.invalid/vera-audit/nonexistent:latest. Its run went from Queued to Started, Running and Failed, with the runErrorMessage Command requires an unavailable container execution engine: example.invalid/vera-audit/nonexistent:latest. It produced no build output, and the log link that listLogSasUrl returned answered 404 from the emulator. That’s what Vera 1.2.0 preview reported; task execution wasn’t rechecked on Vera 1.2.0-rc.3.
  • Task runs use the same interpreter. TaskRuns_Create and TaskRuns_Update run through the same fixed local task interpreter as scheduleRun. Encoded literal echo, printf, true and exit steps can run; builds and container commands fail with no container engine. In tests against Vera 1.2.0’s source, echo succeeded, and docker build and a DockerBuildRequest failed.
  • The build-source upload URL doesn’t take uploads. Registries_GetBuildSourceUploadUrl returns a Blob-style upload URL without creating the sources container it points into. On Vera 1.2.0-rc.3, a PUT to that URL, after only the registry was created, answered HTTP 404 ContainerNotFound.
  • Image import is refused. Registries_ImportImage answers HTTP 409 ImportSourceUnavailable whenever the emulator’s registry engine is attached, as it did for a newly created registry on Vera 1.2.0-rc.3. Without that engine, it copies only from a source registry stored in the emulator, and external source registries answer HTTP 404.
  • Webhook pings aren’t delivered. Webhooks_Ping records a ping event whose eventResponseMessage says delivery wasn’t attempted. It doesn’t send a POST to the webhook’s serviceUri.
  • Docker CLI use wasn’t tried. The round trip above uses the registry’s HTTP API with one config blob and a manifest with no layers. Docker login, push and pull, image layers and multi-platform images weren’t exercised, and nothing was run from the stored image.
  • Not run as examples: geo-replication, webhooks, imports, quarantine, signing, retention, and enforcement of scope maps and tokens. The API coverage marks these from a review of Vera 1.2.0’s source, with their limits in the notes.

API coverage

Section titled “API coverage”

Every operation of the APIs on this page, from their pinned public definitions, and whether Vera 1.2.0 implements it. Only the API surfaces in this release are listed, and each operation once. Implementation availability was reviewed against the Vera 1.2.0 source on 6 November 2026. Source inspection identifies a local implementation and its known limits; it doesn't mean every operation or API version was tested with a request. Each note names its evidence: a Local observation without a build or date is from Vera 1.2.0 preview, on 5 November 2026, and one from a later build, such as Vera 1.2.0-rc.3 or Vera 1.2.2, names that build and its date. No response was compared with Azure's. What the statuses mean

Container Registry management 2025-11-01Plan: Pro

58 of 58 implemented · 2 known differences

Version 2025-11-01, from the Azure REST API specifications at commit 21bbf1b.

CacheRules

5 of 5 implemented
OperationStatusNotes
CacheRules_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
CacheRules_DeleteImplementedSource inspection: Removes local records, with dependency checks.
CacheRules_GetImplementedSource inspection: Answers from local records.
CacheRules_ListImplementedSource inspection: Answers from local records.
CacheRules_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

ConnectedRegistries

6 of 6 implemented
OperationStatusNotes
ConnectedRegistries_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
ConnectedRegistries_DeactivateImplementedSource inspection: Runs as a local action; an external engine running it isn't established.
ConnectedRegistries_DeleteImplementedSource inspection: Removes local records, with dependency checks.
ConnectedRegistries_GetImplementedSource inspection: Answers from local records.
ConnectedRegistries_ListImplementedSource inspection: Answers from local records.
ConnectedRegistries_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

CredentialSets

5 of 5 implemented
OperationStatusNotes
CredentialSets_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
CredentialSets_DeleteImplementedSource inspection: Removes local records, with dependency checks.
CredentialSets_GetImplementedSource inspection: Answers from local records.
CredentialSets_ListImplementedSource inspection: Answers from local records.
CredentialSets_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Operations

1 of 1 implemented
OperationStatusNotes
Operations_ListImplementedSource inspection: Answers from local records.

PrivateEndpointConnections

4 of 4 implemented
OperationStatusNotes
PrivateEndpointConnections_CreateOrUpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
PrivateEndpointConnections_DeleteImplementedSource inspection: Removes local records, with dependency checks.
PrivateEndpointConnections_GetImplementedSource inspection: Answers from local records.
PrivateEndpointConnections_ListImplementedSource inspection: Answers from local records.

Registries

14 of 14 implemented · 1 known difference
OperationStatusNotes
Registries_CheckNameAvailabilityImplementedSource inspection: Answers from local records.
Registries_CreateImplementedLocal observation: Creating a Basic registry with the admin user enabled answered HTTP 200.
Registries_DeleteImplementedLocal observation: Answered HTTP 202, and its operation finished with an empty HTTP 200.
Registries_GenerateCredentialsImplementedSource inspection: Runs as a local action; an external engine running it isn't established.
Registries_GetImplementedLocal observation: Reading the registry answered HTTP 200.
Registries_GetPrivateLinkResourceImplementedSource inspection: Answers from local records.
Registries_ImportImageKnown differenceSource inspection: Refuses with HTTP 409 ImportSourceUnavailable whenever the emulator's registry engine is attached. Otherwise it copies only from a source registry stored in the emulator; external or unavailable source registries return HTTP 404. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — after a registry was created, importing an image into it returned HTTP 409 ImportSourceUnavailable.
Registries_ListImplementedSource inspection: Answers from local records.
Registries_ListByResourceGroupImplementedSource inspection: Answers from local records.
Registries_ListCredentialsImplementedLocal observation: Answered HTTP 200 with the admin username and passwords the emulator generated, which authenticated the registry data requests on this page.
Registries_ListPrivateLinkResourcesImplementedSource inspection: Answers from local records.
Registries_ListUsagesImplementedSource inspection: Answers from local records.
Registries_RegenerateCredentialImplementedSource inspection: Runs as a local action; an external engine running it isn't established.
Registries_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Replications

5 of 5 implemented
OperationStatusNotes
Replications_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
Replications_DeleteImplementedSource inspection: Removes local records, with dependency checks.
Replications_GetImplementedSource inspection: Answers from local records.
Replications_ListImplementedSource inspection: Answers from local records.
Replications_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

ScopeMaps

5 of 5 implemented
OperationStatusNotes
ScopeMaps_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
ScopeMaps_DeleteImplementedSource inspection: Removes local records, with dependency checks.
ScopeMaps_GetImplementedSource inspection: Answers from local records.
ScopeMaps_ListImplementedSource inspection: Answers from local records.
ScopeMaps_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Tokens

5 of 5 implemented
OperationStatusNotes
Tokens_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
Tokens_DeleteImplementedSource inspection: Removes local records, with dependency checks.
Tokens_GetImplementedSource inspection: Answers from local records.
Tokens_ListImplementedSource inspection: Answers from local records.
Tokens_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Webhooks

8 of 8 implemented · 1 known difference
OperationStatusNotes
Webhooks_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
Webhooks_DeleteImplementedSource inspection: Removes local records, with dependency checks.
Webhooks_GetImplementedSource inspection: Answers from local records.
Webhooks_GetCallbackConfigImplementedSource inspection: Answers from local records.
Webhooks_ListImplementedSource inspection: Answers from local records.
Webhooks_ListEventsImplementedSource inspection: Answers from local records.
Webhooks_PingKnown differenceSource inspection: Records a local ping event with its request details, and its eventResponseMessage says delivery wasn't attempted. It doesn't send a POST to serviceUri.
Webhooks_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Registry data 2021-07-01Plan: Pro

29 of 29 implemented

Version 2021-07-01, from the Azure REST API specifications at commit 21bbf1b.

Authentication

3 of 3 implemented
OperationStatusNotes
Authentication_ExchangeAadAccessTokenForAcrRefreshTokenImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
Authentication_ExchangeAcrRefreshTokenForAcrAccessTokenImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
Authentication_GetAcrAccessTokenFromLoginImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.

ContainerRegistry

15 of 15 implemented
OperationStatusNotes
ContainerRegistry_CheckDockerV2SupportImplementedLocal observation: GET /v2/ on the registry's local hostname, with the admin credentials, answered HTTP 200.
ContainerRegistry_CreateManifestImplementedLocal observation: Putting a Docker schema 2 image manifest with no layers, whose config is an uploaded blob, answered HTTP 201, and a GET returned it with HTTP 200. The request had no api-version.
ContainerRegistry_DeleteManifestImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_DeleteRepositoryImplementedLocal observation: Deleting the repository answered HTTP 202.
ContainerRegistry_DeleteTagImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_GetManifestImplementedLocal observation: Returned the Docker schema 2 image manifest put before it, with HTTP 200. The request had no api-version.
ContainerRegistry_GetManifestPropertiesImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_GetManifestsImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_GetPropertiesImplementedLocal observation: Reading a repository's properties answered HTTP 200.
ContainerRegistry_GetRepositoriesImplementedLocal observation: GET /acr/v1/_catalog answered HTTP 200.
ContainerRegistry_GetTagPropertiesImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_GetTagsImplementedLocal observation: Listing a repository's tags answered HTTP 200.
ContainerRegistry_UpdateManifestPropertiesImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_UpdatePropertiesImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistry_UpdateTagAttributesImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.

ContainerRegistryBlob

11 of 11 implemented
OperationStatusNotes
ContainerRegistryBlob_CancelUploadImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_CheckBlobExistsImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_CheckChunkExistsImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_CompleteUploadImplementedLocal observation: Completing a one-request upload of a small JSON config blob, with its digest, answered HTTP 201, and a GET then returned the same bytes. The request had no api-version.
ContainerRegistryBlob_DeleteBlobImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_GetBlobImplementedLocal observation: Downloading the uploaded config blob returned exactly the bytes uploaded. The Docker v2 route had no api-version.
ContainerRegistryBlob_GetChunkImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_GetUploadStatusImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_MountBlobImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.
ContainerRegistryBlob_StartUploadImplementedLocal observation: Starting a blob upload answered HTTP 202, with the upload's address in Location.
ContainerRegistryBlob_UploadChunkImplementedSource inspection: Serves the registry's data API from the emulator's local registry content or its attached registry engine, through the same authentication and repository-scope checks as other registry requests.

Registry tasks 2025-03-01-previewPlan: Pro

25 of 25 implemented · 5 known differences

Version 2025-03-01-preview, from the Azure REST API specifications at commit 21bbf1b.

AgentPools

6 of 6 implemented
OperationStatusNotes
AgentPools_CreateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.
AgentPools_DeleteImplementedSource inspection: Removes local records, with dependency checks.
AgentPools_GetImplementedSource inspection: Answers from local records.
AgentPools_GetQueueStatusImplementedSource inspection: Answers from local records.
AgentPools_ListImplementedSource inspection: Answers from local records.
AgentPools_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

Registries

2 of 2 implemented · 2 known differences
OperationStatusNotes
Registries_GetBuildSourceUploadUrlKnown differenceSource inspection: Records an upload grant and returns a Blob-style upload URL, but doesn't create the sources container that the URL points into. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — after only the registry was created, a PUT to the returned URL answered HTTP 404 ContainerNotFound.
Registries_ScheduleRunKnown differenceLocal observation: A TaskRunRequest naming the task's taskId was accepted and created a run; one with only taskName answered 400 InvalidRequestContent, runRequest.taskId is required. The run of a container step failed with Command requires an unavailable container execution engine and produced no build output.

Runs

5 of 5 implemented · 1 known difference
OperationStatusNotes
Runs_CancelImplementedSource inspection: Runs as a local action; an external engine running it isn't established.
Runs_GetImplementedLocal observation: Read the run's status as it went from Queued to Started, Running and Failed, with a runErrorMessage naming an unavailable container execution engine for the tested container step.
Runs_GetLogSasUrlKnown differenceLocal observation: Returned a local blob-style SAS URL for the failed run's log, but a GET of that URL on the emulator answered 404.
Runs_ListImplementedSource inspection: Answers from local records.
Runs_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.

TaskRuns

6 of 6 implemented · 2 known differences
OperationStatusNotes
TaskRuns_CreateKnown differenceSource inspection: Uses the same fixed local task interpreter as Registries_ScheduleRun: encoded literal echo, printf, true and exit steps can run, but builds and container commands fail with no container engine. Tests against the reviewed source showed echo succeeding and docker build and DockerBuildRequest failing.
TaskRuns_DeleteImplementedSource inspection: Removes local records, with dependency checks.
TaskRuns_GetImplementedSource inspection: Answers from local records.
TaskRuns_GetDetailsImplementedSource inspection: Answers from local records.
TaskRuns_ListImplementedSource inspection: Answers from local records.
TaskRuns_UpdateKnown differenceSource inspection: Uses the same fixed local task interpreter as Registries_ScheduleRun: encoded literal echo, printf, true and exit steps can run, but builds and container commands fail with no container engine. Tests against the reviewed source showed echo succeeding and docker build and DockerBuildRequest failing.

Tasks

6 of 6 implemented
OperationStatusNotes
Tasks_CreateImplementedLocal observation: Creating an enabled Linux task with an encoded step answered HTTP 200.
Tasks_DeleteImplementedLocal observation: Deleting the task answered HTTP 200.
Tasks_GetImplementedLocal observation: Reading the task answered HTTP 200.
Tasks_GetDetailsImplementedSource inspection: Answers from local records.
Tasks_ListImplementedSource inspection: Answers from local records.
Tasks_UpdateImplementedSource inspection: Changes local records only; no workload or infrastructure is established.