{"record":{"id":"f8e77b7e50d56783","repo":"microsoft/aspire","slug":"no-container-registry-associated-with-azure-sandbox-group-f8e77b","errorCode":null,"errorMessage":"No container registry associated with Azure sandbox group '{sandboxResource.Name}'. This should have been added automatically.","messagePattern":"No container registry associated with Azure sandbox group '(.+?)'\\. This should have been added automatically\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs","lineNumber":99,"sourceCode":"                    var resource = SandboxGroup.FromExisting(identifier);\n                    resource.Name = name;\n                    return resource;\n                },\n                infrastructure =>\n                {\n                    var resource = new SandboxGroup(infrastructure.AspireResource.GetBicepIdentifier())\n                    {\n                        Properties = [],\n                        Tags = { { \"aspire-resource-name\", infrastructure.AspireResource.Name } }\n                    };\n                    ApplyManagedServiceIdentity(resource.Identity, sandboxResource, imagePullIdentityId, infrastructure);\n                    return resource;\n                });\n\n            if (newImagePullIdentity is not null)\n            {\n                var registry = sandboxResource.ContainerRegistry ??\n                    throw new InvalidOperationException($\"No container registry associated with Azure sandbox group '{sandboxResource.Name}'. This should have been added automatically.\");\n                var containerRegistry = (ContainerRegistryService)registry.AddAsExistingResource(infrastructure);\n                infrastructure.Add(containerRegistry);\n                var pullRoleAssignment = containerRegistry.CreateRoleAssignment(\n                    ContainerRegistryBuiltInRole.AcrPull,\n                    newImagePullIdentity);\n                // Azure.Provisioning does not currently generate a stable role-assignment name.\n                // See https://github.com/Azure/azure-sdk-for-net/issues/47265.\n                pullRoleAssignment.Name = BicepFunction.CreateGuid(\n                    containerRegistry.Id,\n                    newImagePullIdentity.Id,\n                    pullRoleAssignment.RoleDefinitionId);\n                infrastructure.Add(pullRoleAssignment);\n            }\n\n            infrastructure.Add(new ProvisioningOutput(\"id\", typeof(string)) { Value = sandboxGroup.Id.ToBicepExpression() });\n            infrastructure.Add(new ProvisioningOutput(\"name\", typeof(string)) { Value = sandboxGroup.Name.ToBicepExpression() });\n            infrastructure.Add(new ProvisioningOutput(\"location\", typeof(string)) { Value = sandboxGroup.Location.ToBicepExpression() });\n            infrastructure.Add(new ProvisioningOutput(AzureSandboxGroupResource.ImagePullIdentityClientIdOutputName, typeof(string))","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs#L81-L117","documentation":"While publishing the sandbox group's infrastructure, a newly created image-pull identity needs an AcrPull role assignment, which requires a container registry. The registry should have been registered on the sandbox resource automatically; its absence signals the same missing-registry invariant as during deployment-target preparation, and the publish step fails.","triggerScenarios":"Publishing (AddAzureSandboxGroup provisioning callback) when a new image-pull identity was created but sandboxResource.ContainerRegistry is null — e.g. the default registry was removed from the model or never attached because the registry-adding logic did not run.","commonSituations":"Custom model mutation removing the auto-created registry resource; running a publish pipeline where the registry-adding module was skipped or ordered incorrectly; an internal bug where the sandbox resource was constructed without its default registry.","solutions":["Ensure a container registry is associated with the sandbox group: rely on the automatic registry creation, or explicitly set ContainerRegistry to an existing ACR resource.","Verify any ContainerRegistryReferenceAnnotation logic actually adds a registry resource to the model before the sandbox infrastructure is built.","Remove custom code that strips the registry resource from the application model.","Update the Aspire.Hosting.Azure.Sandboxes package if the automatic registry attachment is missing in your version."],"exampleFix":"// before (registry removed by custom code)\nmodel.Resources.Remove(defaultRegistry);\n\n// after (explicit existing registry)\nsandboxResource.ContainerRegistry = existingAcrResource;","handlingStrategy":"validation","validationCode":"if (sandboxResource.ContainerRegistry is null)\n{\n    throw new InvalidOperationException(\"ContainerRegistry missing on sandbox resource; attach a registry before publishing.\");\n}","typeGuard":null,"tryCatchPattern":"try { await publishPipeline.RunAsync(); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"No container registry associated with Azure sandbox group\")) { /* register a registry resource and rerun */ }","preventionTips":["Let the library auto-create the registry unless you explicitly supply one.","Avoid custom pipeline steps that remove registry resources from the model.","Assert sandboxResource.ContainerRegistry is not null in a pre-publish smoke test."],"tags":["azure","sandbox-group","container-registry","publish","internal-invariant"],"backgroundTag":"internal-invariant-violation","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}