Add an Azure Container Apps sample (guestbook on ACR + Blob Storage)

[lazarkanelov]

What

A new sample, samples/container-apps-blob-storage/python: a Flask guestbook running on Azure Container Apps, pulling its image from ACR and storing entries as a JSON blob in Blob Storage. It mirrors the aci-blob-storage sample's structure (CLI scripts + Bicep + Terraform variants, numbered deploy steps, validate.sh check harness, cleanup.sh).

Instead of Key Vault, the storage connection string is stored as a Container Apps secret and injected through a secretref: environment variable — the idiomatic ACA pattern, and what differentiates this sample from the ACI one.

Container Apps features exercised

• az containerapp env create (managed environment)
• App create from a private registry with explicit --registry-* credentials
• Secrets (--secrets + secretref: env var, secret list/show in validate)
• External HTTP ingress + live requests through the returned FQDN
• Multiple-revisions mode: validate.sh rolls out a v2 revision with az containerapp update, asserts both revisions exist, that v2 serves traffic (the app reports its revision in /health and the UI), and that entries survive the switch
• Min/max replicas, an HTTP scale rule, replica list

The Bicep template pins Microsoft.App@2025-07-01 (the api-version the az CLI uses); the Terraform variant uses azurerm_container_app_environment / azurerm_container_app on azurerm 4.81.0.

Wiring

• run-samples.sh: registered in SAMPLES, TERRAFORM_SAMPLES, BICEP_SAMPLES, and ARM64_SAMPLE_DIRS (the sample builds its own image from a multi-arch base, and the k3d runtime images are multi-arch) — the CI matrix picks it up via --list
• Top-level README.md: outline row + architecture-support table row

Verification

Run end-to-end against a current emulator dev build (LS_AZURE_CONTAINER_APPS_RUNTIME on by default):

• scripts/deploy.sh + scripts/validate.sh: 28/28 checks pass, including the HTTP round trip through http://<fqdn>:4566 and the v2 rollout
• Bicep and Terraform deploys: app healthy with storage_configured: true, entry round trip verified
• cleanup.sh removes everything including the environment's k3d cluster
• Works with and without ENVIRONMENT=LocalStack (the emulator returns an http:// blob endpoint natively)

Note: validate.sh re-states AZURE_STORAGE_CONNECTION_STRING=secretref:storage-conn in the az containerapp update call. Without it, the CLI's read-modify-write of the env list round-trips the value: "" the emulator echoes alongside secretRef, and the new revision's pod loses the secret env (control plane keeps the secretRef, so only the data plane breaks). Harmless on real Azure, and the check keeps passing once the emulator omits value for secret-backed env vars.

CI dependency: the sample needs Container Apps support in the released localstack/localstack-azure:latest image; it was verified against a local dev build that includes it.

[Copilot]

Pull request overview

Adds a new end-to-end sample under samples/container-apps-blob-storage/python demonstrating a Flask “guestbook” deployed to Azure Container Apps, pulling from ACR, and persisting entries in Blob Storage (with the storage connection string injected via a Container Apps secret). The sample is wired into the repo’s sample runner and top-level documentation.

Changes:

• Introduces a new Container Apps + Blob Storage Python sample app (Flask UI + Blob-backed persistence) with deploy/validate/cleanup scripts.
• Adds IaC variants for the same sample (Bicep and Terraform), including ACR image build/push steps and Container Apps configuration (secrets, ingress, revisions, scaling).
• Registers the sample in run-samples.sh and adds it to the top-level README.md tables (including arm64 support notes).

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
samples/container-apps-blob-storage/python/terraform/variables.tf	Terraform input variables for the sample.
samples/container-apps-blob-storage/python/terraform/README.md	Terraform deployment instructions for the sample.
samples/container-apps-blob-storage/python/terraform/providers.tf	Terraform/provider requirements and LocalStack azurerm config.
samples/container-apps-blob-storage/python/terraform/outputs.tf	Terraform outputs (RG, storage, ACR, ACA FQDN, revision).
samples/container-apps-blob-storage/python/terraform/main.tf	Terraform resources for Storage + ACA environment/app + secrets/ingress/scale.
samples/container-apps-blob-storage/python/terraform/deploy.sh	Terraform flow script (pre-create ACR, build/push image, apply).
samples/container-apps-blob-storage/python/src/templates/index.html	Guestbook UI template showing revision and entries.
samples/container-apps-blob-storage/python/src/requirements.txt	Python dependencies (Flask + azure-storage-blob).
samples/container-apps-blob-storage/python/src/Dockerfile	Container image build for the guestbook app.
samples/container-apps-blob-storage/python/src/blob_storage_client.py	Blob Storage persistence client (single JSON blob).
samples/container-apps-blob-storage/python/src/app.py	Flask app routes (/ , /delete, /health) and client initialization.
samples/container-apps-blob-storage/python/scripts/validate.sh	Validation harness exercising ACA secrets, ingress, replicas, revisions, and HTTP checks.
samples/container-apps-blob-storage/python/scripts/README.md	Azure CLI deployment/validation docs for the scripts variant.
samples/container-apps-blob-storage/python/scripts/deploy.sh	Azure CLI deployment script for Storage + ACR + ACA (secretref env).
samples/container-apps-blob-storage/python/scripts/cleanup.sh	Cleanup script removing app/env/ACR/storage/RG.
samples/container-apps-blob-storage/python/README.md	Sample-level README (architecture, quick start, variants).
samples/container-apps-blob-storage/python/bicep/README.md	Bicep deployment instructions for the sample.
samples/container-apps-blob-storage/python/bicep/main.bicepparam	Bicep parameter file for prefix/suffix/image inputs.
samples/container-apps-blob-storage/python/bicep/main.bicep	Bicep template for Storage + ACR + ACA (secrets/ingress/scale).
samples/container-apps-blob-storage/python/bicep/deploy.sh	Bicep flow script (build/push image then group deployment).
run-samples.sh	Registers the new sample in CLI/Bicep/Terraform matrices and arm64 list.
README.md	Adds the new sample to the repository overview + architecture support table.

Suppressed comments (2)

samples/container-apps-blob-storage/python/src/app.py:56

• This exception handler catches ConnectionError/ValueError/KeyError, but Azure SDK read failures are usually not ConnectionError. If BlobGuestbookClient._read_blob is updated to raise on read errors (to prevent silent data loss), this handler should catch those exceptions too.

    except (ConnectionError, ValueError, KeyError) as e:
        logger.error("Error reading entries: %s", e)

samples/container-apps-blob-storage/python/src/app.py:76

• Same as above: catching only the built-in ConnectionError is unlikely to intercept Azure SDK/network failures. Catch a broader exception type and log the stack trace so failed deletes don't crash the request handler.

    except (ConnectionError, ValueError) as e:
        logger.error("Error deleting entry: %s", e)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[paolosalvatori]

Thanks for quickly building a sample with ACA. Please, see my comments, suggestions, requests for changes. In addition, look at GitHub Copilot comments and suggestions. You can them merge updates, so we officially have our first ACA sample 🎉

[lazarkanelov]

CI note: the red runs on this PR were not the sample — three separate infra events, now handled:

1. Two Start LocalStack timeouts on slow runners (localstack wait -t 300 expired mid-bootstrap, different shard each time) — fixed in 8f07cd1 by raising the readiness wait to 600s, same rationale as the earlier 120s→300s bump.
2. One Docker Hub auth timeout during the image pull (network flake, cleared on rerun).
3. web-app-mysql-flexible-server failing deterministically since ~15:00 UTC: GitHub's runner-image rollout (ubuntu22/20260810.260) bumped the preinstalled az CLI 2.88.0 → 2.89.0, and the emulator answers the new az mysql flexible-server firewall-rule create payload with a 500 (AttributeError: 'NoneType' object has no attribute 'start_ip_address' in mysql_flexible/apis/firewall_rules.py — the body parses to a None properties). Same emulator image digest passed with az 2.88.0 minutes earlier, so the CLI version is the only variable. 2f47f5f pins az to 2.88.0 in the workflow (with the removal trigger in the step comment) so all shards stay green until the emulator handles the 2.89 shape — this would otherwise break every PR in the repo, not just this one. The postgresql flexible-server handler is worth checking for the same None-properties pattern.