From 2492a619b71033d7051d6270046e6e9061587738 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Tue, 21 Jul 2026 17:12:08 -0700
Subject: [PATCH] Build docker-image-refresh via ACR Tasks (az acr build) to
 avoid Docker Hub

On the network-isolated 1ES pool the agent cannot reach registry-1.docker.io, so 'docker run tonistiigi/binfmt' and 'docker buildx create' (which pull moby/buildkit) fail with a connection timeout. Replace the local docker/buildx path with a server-side 'az acr build': ACR pulls the base from MCR and pushes the result, with no local Docker daemon, no QEMU/binfmt, and no Docker Hub dependency.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
---
 .azure-pipelines/docker-image-refresh.yml | 36 +++++++++--------------
 1 file changed, 14 insertions(+), 22 deletions(-)

diff --git a/.azure-pipelines/docker-image-refresh.yml b/.azure-pipelines/docker-image-refresh.yml
index b9f987d2bb..59294a3688 100644
--- a/.azure-pipelines/docker-image-refresh.yml
+++ b/.azure-pipelines/docker-image-refresh.yml
@@ -24,6 +24,7 @@ parameters:
 
 variables:
   REGISTRY: 'msgraphprodregistry.azurecr.io'
+  REGISTRY_NAME: 'msgraphprodregistry'   # ACR resource name (az acr build uses this, not the FQDN)
   IMAGE_NAME: 'public/microsoftgraph/powershell'
 
 # Rebuild weekly so the image regularly picks up patched OS layers. `always: true` forces a run
@@ -71,31 +72,22 @@ extends:
         steps:
         - checkout: self
 
+        # Build server-side with ACR Tasks: no local Docker daemon, no buildx/QEMU, and no
+        # Docker Hub dependency (which the network-isolated 1ES pool can't reach). ACR pulls the
+        # base image from MCR and pushes the result back to the registry.
         - task: AzureCLI@2
-          displayName: 'Log in to Azure Container Registry'
+          displayName: 'Build and push patched image (ACR Tasks)'
           inputs:
             azureSubscription: 'ACR Images Push Service Connection'
             scriptType: 'bash'
             scriptLocation: 'inlineScript'
             inlineScript: |
-              az acr login --name $(REGISTRY)
-
-        - script: |
-            docker run --privileged --rm tonistiigi/binfmt --install all
-          displayName: 'Enable multi-platform builds'
-
-        - script: |
-            docker buildx create --use --name refreshbuilder
-          displayName: 'Set up Docker BuildX'
-
-        - bash: |
-            set -euo pipefail
-            formatted_date=$(date +"%Y%m%d%H%M%S")
-            echo "Rebuilding $(REGISTRY)/$(IMAGE_NAME) on a patched base"
-            docker buildx build \
-              --platform linux/amd64 \
-              --push \
-              -t "$(REGISTRY)/$(IMAGE_NAME):latest" \
-              -t "$(REGISTRY)/$(IMAGE_NAME):$formatted_date" \
-              "$(Build.SourcesDirectory)"
-          displayName: 'Build and push refreshed image'
+              set -euo pipefail
+              formatted_date=$(date +"%Y%m%d%H%M%S")
+              echo "Rebuilding $(REGISTRY_NAME) / $(IMAGE_NAME) on a patched base via ACR Tasks"
+              az acr build \
+                --registry $(REGISTRY_NAME) \
+                --image "$(IMAGE_NAME):latest" \
+                --image "$(IMAGE_NAME):$formatted_date" \
+                --platform linux/amd64 \
+                "$(Build.SourcesDirectory)"