How to enable retention policy on ACR

[eerhardt]

The current deployment situation for ACA and AppService is to push to a Azure Container Registry (ACR). By default, old images are never purged from the ACR.

There is a preview feature in ACR: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-retention-policy. But this feature requires:

1. A Premimum SKU ACR
2. Requires that the old images be untagged.

Azure Container Registry gives you the option to set a retention policy for stored image manifests that don't have any associated tags. When you enable a retention policy, the registry automatically deletes untagged manifests after the number of days you set. This feature prevents the registry from filling up with unneeded artifacts and helps you save on storage costs.

Setting the SKU is relatively easy. But the issue is the "untagged" manifests part. By default Aspire will tag every image with a date stamped tag:

So when new images are pushed, a new tag is created. Which means the old images will never be untagged.

Should we change the tagging policy on these images? We have an escape hatch for people to do it themselves. But should we update the default behavior?

cc @davidfowl @mitchdenny @DamianEdwards

[DamianEdwards]

I think it's clear our defaults aren't good here. Retaining images forever and having the registries fill up and/or trigger compliance issues due to old images staying around isn't the place we want to be as a baseline. I'm thinking we change are defaults to simply tagging with latest and let users change that if they want to.

[davidfowl]

Maybe we have a discussion with the ACR team to see what a good default might be for these situations.