About Azure Container Instances
Azure Container Instances is a managed Azure service for running Linux or Windows containers without provisioning or managing virtual machines. It is designed for workloads that need fast startup and direct control over container images, CPU, memory, networking, and restart behavior without requiring a full orchestration platform. ACI sits between raw virtual machines and higher-level container platforms such as Azure Container Apps and Azure Kubernetes Service. It is especially useful for short-lived jobs, burst workloads, build and test tasks, simple services, and isolated container workloads that do not need a full application platform.
What is included
Runtime
| Operating systems | Linux and Windows container groups |
|---|---|
| Deployment unit | Container group |
Compute
| Billing granularity | Per-second vCPU and memory usage based on requested resources |
|---|
Networking
| Private networking | Azure virtual network deployment supported; NAT Gateway required for supported outbound connectivity in a VNet |
|---|
Identity
| Managed identity | Supported for Azure service authentication and Azure Container Registry image pull |
|---|
Security
| Confidential containers | Supported for selected Linux workloads using trusted execution environments |
|---|
Resilience
| Availability zones | Zonal container-group deployment supported in eligible regions |
|---|
Cost
| Spot containers | Preview option for interruptible workloads with discounts advertised up to 70 percent |
|---|
What is Azure Container Instances best used for?
Azure Container Instances is a good fit when a team already has a container image and wants to run it quickly without creating a VM cluster or Kubernetes environment. Common uses include batch-style jobs, build or test tasks, data processing, rendering, automation workers, temporary services, and simple web workloads. Microsoft also supports multi-container groups when related containers need to share the same host, network, storage, and lifecycle. For larger application platforms with built-in service discovery, revision management, autoscaling rules, and application lifecycle features, Azure Container Apps or AKS will usually provide a more complete operating model.
How do container groups, CPU, and memory work?
The main deployment unit in ACI is the container group. A group can contain one or more containers that share lifecycle and selected network or storage resources. Customers request vCPU and memory for the group, and Microsoft schedules that workload on managed infrastructure. The current pricing model bills container-group compute by the second, based on requested vCPU and memory, rather than charging for a VM that the customer manages. Microsoft currently documents a minimum of 1 vCPU and 1 GB of memory, up to 4 vCPU per container group in the standard pricing description, with memory limits tied to requested CPU. Regional quotas and feature-specific limits should still be checked before production deployment.
How does Azure Container Instances pricing work?
Pricing was checked on August 27, 2026. Microsoft currently bills ACI at the container-group level based on the requested vCPU and memory for the time the group is running. Windows groups can also incur a Windows software-duration charge. Microsoft offers pay-as-you-go pricing and lists eligible savings-plan options for selected compute usage. Spot container groups use unused Azure capacity at a discount but can be evicted and are not suitable for workloads that require steady availability. Confidential container groups also carry their own pricing. Exact rates vary by region, operating system, purchase agreement, and workload configuration, so buyers should use the Azure pricing calculator for a specific estimate.
What networking and storage options are available?
ACI can expose a container group through a public IP address and fully qualified domain name, or it can place a group into an Azure virtual network for private connectivity. Microsoft currently requires a NAT Gateway for supported outbound connectivity when a container group is deployed inside a virtual network. ACI can also communicate with on-premises resources through Azure networking such as VPN Gateway or ExpressRoute when the surrounding virtual network is configured for that path. For persistent files, ACI can mount Azure Files shares. Teams should not treat the local container filesystem as durable application storage because container replacement or restart can remove local state.
What security and identity features should buyers understand?
Microsoft states that ACI uses hypervisor-level isolation for container groups. Managed identities can be assigned to container groups so applications can authenticate to supported Azure services without embedding credentials in the image. ACI can also use a managed identity to pull images from Azure Container Registry. Confidential containers are available for selected Linux scenarios and use trusted execution environments to protect data in use. Microsoft also requires secure connections from servers and applications to use TLS 1.2. Buyers remain responsible for the security of the image, application code, secrets, dependencies, exposed ports, identities, and data that the container processes.
How do Spot, confidential containers, and availability zones differ?
Standard container groups are the normal choice for steady on-demand workloads. Spot container groups are intended for interruptible workloads that can tolerate eviction; Microsoft currently advertises discounts of up to 70 percent compared with regular-priority ACI containers, but the feature remains preview and should not be treated as production capacity with strict availability requirements. Confidential containers add hardware-backed protection for data in use but have feature restrictions, including no Windows or GPU confidential-container support in the current documentation. ACI also supports zonal deployment in regions that support Availability Zones, allowing a container group to be pinned to a chosen zone.
How does ACI compare with Container Apps and AKS?
ACI is the lowest-operations option when the goal is simply to run isolated containers without managing VMs. Azure Container Apps adds an application platform with ingress, service discovery, revisions, traffic splitting, and richer autoscaling. AKS adds Kubernetes APIs, controllers, scheduling, policy, ecosystem tooling, and deeper cluster-level orchestration. ACI can complement AKS through virtual nodes, where Kubernetes pods can run on ACI-backed serverless infrastructure for burst capacity. Buyers should choose ACI when simplicity and direct container execution matter more than full orchestration or application-platform features.
What limitations should teams plan around?
ACI is not a full replacement for Kubernetes or a managed application platform. Microsoft currently documents no ARM64 container-image support, no privileged container operations, a 15 GB container-image size consideration, and Linux-only support for some features such as multi-container groups, selected volume mounts, resource metrics, and legacy GPU scenarios. Container-group public IP addresses can change after restarts, so applications should avoid hard-coded addresses. Platform maintenance can also restart container groups. Regional quota, feature availability, virtual-network design, and image compatibility should be checked before adopting ACI for a production architecture.
Who should choose something else?
Choose Azure Container Apps when you want serverless containers plus built-in application lifecycle features, scaling rules, traffic splitting, and service discovery. Choose AKS when Kubernetes compatibility, advanced orchestration, custom controllers, policy, or a broad container ecosystem is a requirement. Choose Azure Batch when the main problem is scheduling and managing large numbers of compute jobs. Choose Azure Virtual Machines when an application needs operating-system control, privileged operations, or software that does not fit the container model. ACI is strongest when a workload is already containerized, relatively self-contained, and benefits from fast on-demand execution without the operational weight of a larger platform.
Reviews
No reviews yet
Nobody has reviewed Azure Container Instances here yet.