IPv6 Dual-Stack Endpoints for Azure Container Registry (Public Preview)

By Johnson Shi, Aviral Takkar, Bin Du

Introduction

Two of the most common networking questions we hear from teams running Azure Container Registry (ACR) are:

1. "Can my registry serve clients on IPv6 networks?" — Teams operating IPv6-only or dual-stack networks need their container registry reachable over IPv6.
2. "How do we start moving registry traffic toward IPv6 without breaking anything?" — Organizations guarding against IPv4 address exhaustion, or operating under IPv6 transition mandates, want a migration path that doesn't disrupt existing IPv4 clients.

Today, we're announcing the public preview of IPv6 dual-stack endpoints for Azure Container Registry for public endpoints and firewall rules, with IPv6 over private endpoints planned for GA. Set your registry's endpoint protocol to IPv4AndIPv6, and its endpoints become reachable over both IPv4 and IPv6 — so IPv4-only, dual-stack, and IPv6-capable clients all connect to the same registry, each over whichever protocol their network stack selects.

Key Takeaways

• ACR registries now support an endpointProtocol setting with two values: IPv4 (default) and IPv4AndIPv6 (dual stack, preview).
• Dual stack is additive — your registry continues serving IPv4 clients exactly as before. There is no IPv6-only mode.
• Dual stack requires dedicated data endpoints to be enabled (--data-endpoint-enabled true), and dedicated data endpoints require the Premium SKU. The service enforces this requirement.
• You can enable it today with Azure CLI 2.87.0 via az acr update --endpoint-protocol IPv4AndIPv6.
• FQDN-based client firewall rules keep working unchanged; IP-based allowlists need to account for IPv6 traffic.
• Limitation: This public preview covers IPv6 for the registry's public endpoints and firewall rules only. IPv6 over private endpoints is planned for a future release.

• Limitation: ACR Tasks isn't supported on a registry that has IPv6 dual-stack enabled. Tasks does not work when the endpoint protocol isIPv6 dual-stack, including quick builds (with az acr build) and quick task runs (with az acr run). Support is planned for a future release.

How to enable it

On an existing registry (Azure CLI 2.87.0 or later)

Dual stack requires dedicated data endpoints, so enable both in a single update:

az acr update --name <your-registry> --data-endpoint-enabled true --endpoint-protocol IPv4AndIPv6

If dedicated data endpoints are already enabled, set the endpoint protocol on its own:

az acr update --name <your-registry> --endpoint-protocol IPv4AndIPv6

Verify the configuration:

az acr show --name <your-registry> --query "{endpointProtocol:endpointProtocol, dataEndpointEnabled:dataEndpointEnabled}"

{
  "dataEndpointEnabled": true,
  "endpointProtocol": "IPv4AndIPv6"
}

Note: If your clients sit behind a firewall and you're enabling dedicated data endpoints for the first time, add firewall rules for <your-registry>.<region>.data.azurecr.io before enabling — switching from *.blob.core.windows.net to dedicated data endpoints changes where layer blobs are downloaded from. See Dedicated data endpoints for details.

Reverting to IPv4

Dual stack is reversible at any time:

az acr update --name <your-registry> --endpoint-protocol IPv4

Reverting the endpoint protocol leaves dedicated data endpoints enabled; disable them separately if desired.

Scope of this preview

This public preview enables IPv6 for the registry's public endpoints — the login server, dedicated data endpoints, and regional endpoints (if enabled). IPv6 over private endpoints isn't part of this preview. Support is planned for a future release. Until then, registries reached through a private endpoint continue to use IPv4.

Additionally, IPv6 dual-stack support for ACR Tasks, including support for `az acr build` and `az acr run`, are not supported in the public preview. Support is planned for a future release.

Requirements and how features compose

For geo-replicated registries, the endpoint protocol is a registry-level setting, and dedicated data endpoints exist in every replica region. Firewall guidance: rules based on registry FQDNs — the login server, dedicated data endpoints, and regional endpoints (if enabled) — continue to work unchanged for dual-stack registries; only IP-address-based allowlists need updating for IPv6.

To learn more, see IPv6 dual-stack endpoints in Azure Container Registry (preview) and the ACR endpoint reference.

If you have further questions about IPv6 dual-stack endpoints or dedicated data endpoints, reach out to us on the Azure Container Registry GitHub repository or file feedback through the Azure portal.