fix: avm+waf deployment

[Ayaz-Microsoft]

Purpose

This pull request introduces logic to better support deployments using the default Microsoft bootstrap container image (azuredocs/containerapps-helloworld) for both backend and MCP container apps. The main improvements are conditional configuration of container port and registry settings based on the image in use, as well as several infrastructure and configuration updates.

Conditional container app configuration:

• Added detection variables (backendUsesBootstrapImage, mcpUsesBootstrapImage) to check if the Microsoft bootstrap image is used for backend or MCP containers. [1] [2] [3]
• Updated ingressTargetPort to use port 80 when the bootstrap image is used, otherwise defaulting to the previous ports (8000 for backend, 9000 for MCP). [1] [2] [3] [4] [5] [6]
• Set registries to null when using the bootstrap image, otherwise configured as before. This avoids unnecessary registry authentication for public images. [1] [2] [3] [4] [5] [6]

Infrastructure and configuration updates:

• Updated template hashes and resource definitions in generated main.json files to reflect the above logic and other minor changes. [1] [2] [3] [4] [5]
• Added or updated several environment variables and settings for image generation, logging, and networking, including support for vnetRouteAllEnabled, imagePullTraffic, and new image-related environment variables. [1] [2] [3] [4] [5]
• Changed the default for virtualMachineAvailabilityZone to -1 in main.json.
• Updated example model name in the model parameter description.

These changes make the deployment templates more robust and flexible, especially when using the default Microsoft bootstrap container image, and improve overall infrastructure configuration.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR improves deployment robustness for both AVM and vanilla Bicep flows when initially provisioning Container Apps with the public Microsoft bootstrap image (mcr.microsoft.com/azuredocs/containerapps-helloworld). It does this by conditionally configuring Container App ingress ports and registry settings based on whether the bootstrap image is being used, and by updating the post-provision scripts to swap images and ports after build/push.

Changes:

• Add “bootstrap image” detection variables and use them to set ingressTargetPort to 80 (bootstrap) vs 8000/9000 (real backend/MCP images).
• Set Container App registries to null when using the public bootstrap image (avoids unnecessary ACR auth config).
• Update post-provision image push scripts to update both image and ingress port for backend/MCP container apps.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
infra/scripts/post-provision/Build-And-Push-Images.ps1	Adds a helper to update Container App image + ingress port + registries during post-provision.
infra/scripts/post-provision/build_and_push_images.sh	Adds a jq-based helper to update Container App image + ingress port + registries during post-provision; enforces jq presence.
infra/main.json	Updates generated router template to include bootstrap-image conditionals for ingress ports/registries.
infra/bicep/main.json	Updates generated vanilla Bicep ARM template with bootstrap-image conditionals and related settings.
infra/bicep/main.bicep	Adds bootstrap-image conditionals for Container App ingress target ports and registry config.
infra/avm/main.json	Updates generated AVM ARM template with bootstrap-image conditionals and related settings.
infra/avm/main.bicep	Adds bootstrap-image conditionals for Container App ingress target ports and registry config.

Suppressed comments (1)

infra/avm/main.json:59688

• The frontend Web App container listens on port 3000 (src/App/Dockerfile exposes 3000 and runs uvicorn on 3000), but WEBSITES_PORT isn’t set in these appSettings. That will prevent App Service from routing traffic to the container until the post-provision script patches settings, and breaks deployments that don’t run the post-provision hook.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.