如何通过Azure DevOps流水线部署Azure Web应用容器时传递动态变量/密钥并修改运行时设置？

Hey there! Let’s break down your two questions step by step—both are super common when working with Azure DevOps and containerized Web Apps, so I’ve got you covered.

There are a few secure, practical ways to handle this, depending on whether you’re dealing with regular variables or sensitive secrets:

• Azure Web App Application Settings (Most Recommended)
  Azure Web Apps automatically inject application settings as environment variables into your container. In your Azure DevOps release pipeline, use the Azure Web App for Containers task, then navigate to the Application and Configuration Settings section. Here you can add key-value pairs directly. For secrets, reference Azure DevOps secret variables (e.g., $(DbPassword))—just make sure you’ve marked those variables as "Keep this value secret" in your pipeline or variable group. This method keeps secrets safe and avoids hardcoding them into your image.

• Azure Key Vault Integration (For Sensitive Secrets)
  Store critical secrets in Azure Key Vault, then link the vault to an Azure DevOps variable group. In your pipeline, pull these secrets into pipeline variables, then pass them to the Web App’s application settings via the deployment task. This adds an extra layer of security and makes it easy to rotate secrets without touching your pipeline.

• Docker Run Arguments (Only for Non-Sensitive Variables)
  If your app expects variables directly from the docker run command, you can add arguments in the Container Settings section of the deployment task (e.g., --env API_URL=$(ApiBaseUrl)). Note: Avoid using this for secrets, as run arguments can appear in logs and expose sensitive data.

This is not only feasible—it’s a best practice! Keeping your image configuration-agnostic lets you reuse the same build across multiple environments (dev, test, prod) without rebuilding. Here’s the optimal approach:

• Override Settings via Web App Application Settings (Primary Method)
  Your build pipeline should create a base image with default, environment-agnostic settings. Then, in your release pipeline, use the Azure Web App for Containers task to override specific settings per environment. For example:

  • If your image defaults to APP_ENV=development, set APP_ENV=production in your production release stage.
  • These overrides are injected as environment variables at runtime, so your app just needs to prioritize reading environment variables over embedded config files (most modern frameworks support this out of the box).

• Use Environment-Specific Variable Groups
  Create separate variable groups for each environment (e.g., Dev-Config, Prod-Config) in Azure DevOps. Store the settings you need to modify in these groups, then link the appropriate group to each stage in your release pipeline. This keeps your environment configurations organized and consistent.

• Mount External Config Files (For File-Based Configs)
  If your app relies on local config files (like appsettings.json), you can store environment-specific versions in Azure DevOps Secure Files or Azure Blob Storage. Use the Azure File Copy task in your release pipeline to upload the config file to the Web App’s persistent storage (e.g., /home/site/wwwroot), or use Web App’s volume mount feature to attach the file directly to the container. This is less straightforward than environment variables, but useful for legacy apps.

Quick Notes to Remember #

• Ensure your app code is set up to read environment variables (e.g., Environment.GetEnvironmentVariable() for .NET, os.environ.get() for Python) to pick up the overrides.
• Never commit sensitive settings to your codebase or image—always use Azure DevOps secrets or Key Vault.

内容的提问来源于stack exchange，提问作者Himanshu Mundeepi