Manage Azure Container Registry Artifacts

This skill manages container images, artifacts, and repositories in Azure Container Registry using the Python SDK (pip install azure-containerregistry). A ContainerRegistryClient authenticates against a registry endpoint via DefaultAzureCredential (recommended for private registries) or anonymously with an explicit audience for public registries like Microsoft Container Registry. Repository operations cover listing all repository names, getting a repository's properties (creation/modification time, manifest count, tag count), updating its properties (e.g. can_delete/can_write flags to lock it down), and deleting it outright. Tag operations list a repository's tags (optionally ordered by ArtifactTagOrder.LAST_UPDATED_ON_DESCENDING for most-recent-first), fetch a specific tag's properties (digest, creation time), and delete a tag by name. Manifest operations mirror this at the manifest level: listing manifests (ordered similarly), getting a manifest's properties (digest, architecture, OS), updating its lock flags, and deleting it - explicitly by digest rather than by tag, to avoid leaving orphaned untagged images behind when multiple tags point to the same digest. Raw artifact content can be pulled directly via download_manifest (media type and digest) and download_blob (streamed layer content written to a local file in chunks). An async client (azure.containerregistry.aio) mirrors the sync API for high-throughput scenarios. A worked cleanup example iterates a repository's manifests, and deletes any manifest older than a 30-day cutoff that has no tags pointing to it - a common registry-hygiene pattern - checking manifest.tags first specifically to avoid removing images still in active use.

Use this skill when programmatically managing Azure Container Registry contents - auditing repositories, pruning old or untagged images, locking production images against deletion, or pulling manifest/layer content directly. It is not a build or push tool (image building and pushing typically go through Docker/OCI tooling or CI/CD pipelines) - this SDK is focused on registry management, inspection, and cleanup of already-pushed artifacts.

Input is a registry endpoint, repository names, and tag/digest identifiers. Output is repository/tag/manifest metadata (timestamps, counts, digests, architecture/OS), downloaded manifest and blob content, and confirmation of updates or deletions.

Built on the Azure Container Registry Python SDK (ContainerRegistryClient), authenticated via Azure Identity's DefaultAzureCredential for private registries or anonymously (with an explicit audience) for public ones like mcr.microsoft.com.

pip install azure-containerregistry

Python developers and platform teams managing Azure Container Registry contents - auditing, cleaning up old or untagged images, locking production images, or pulling artifact content programmatically - rather than through the Azure CLI or portal.