microsoft/aspire · error · InvalidOperationException

No container registry associated with Azure sandbox group

Error message

No container registry associated with Azure sandbox group '{sandboxResource.Name}'. This should have been added automatically.

What it means

While publishing the sandbox group's infrastructure, a newly created image-pull identity needs an AcrPull role assignment, which requires a container registry. The registry should have been registered on the sandbox resource automatically; its absence signals the same missing-registry invariant as during deployment-target preparation, and the publish step fails.

Solutions

Ensure a container registry is associated with the sandbox group: rely on the automatic registry creation, or explicitly set ContainerRegistry to an existing ACR resource.
Verify any ContainerRegistryReferenceAnnotation logic actually adds a registry resource to the model before the sandbox infrastructure is built.
Remove custom code that strips the registry resource from the application model.
Update the Aspire.Hosting.Azure.Sandboxes package if the automatic registry attachment is missing in your version.

Example fix

// before (registry removed by custom code)
model.Resources.Remove(defaultRegistry);

// after (explicit existing registry)
sandboxResource.ContainerRegistry = existingAcrResource;

Defensive patterns

Strategy: validation

Validate before calling

if (sandboxResource.ContainerRegistry is null)
{
    throw new InvalidOperationException("ContainerRegistry missing on sandbox resource; attach a registry before publishing.");
}

Try / catch

try { await publishPipeline.RunAsync(); } catch (InvalidOperationException ex) when (ex.Message.Contains("No container registry associated with Azure sandbox group")) { /* register a registry resource and rerun */ }

Prevention

Let the library auto-create the registry unless you explicitly supply one.
Avoid custom pipeline steps that remove registry resources from the model.
Assert sandboxResource.ContainerRegistry is not null in a pre-publish smoke test.

When it happens

Trigger: Publishing (AddAzureSandboxGroup provisioning callback) when a new image-pull identity was created but sandboxResource.ContainerRegistry is null — e.g. the default registry was removed from the model or never attached because the registry-adding logic did not run.

Common situations: Custom model mutation removing the auto-created registry resource; running a publish pipeline where the registry-adding module was skipped or ordered incorrectly; an internal bug where the sandbox resource was constructed without its default registry.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/f8e77b7e50d56783. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs:99

                    var resource = SandboxGroup.FromExisting(identifier);
                    resource.Name = name;
                    return resource;
                },
                infrastructure =>
                {
                    var resource = new SandboxGroup(infrastructure.AspireResource.GetBicepIdentifier())
                    {
                        Properties = [],
                        Tags = { { "aspire-resource-name", infrastructure.AspireResource.Name } }
                    };
                    ApplyManagedServiceIdentity(resource.Identity, sandboxResource, imagePullIdentityId, infrastructure);
                    return resource;
                });

            if (newImagePullIdentity is not null)
            {
                var registry = sandboxResource.ContainerRegistry ??
                    throw new InvalidOperationException($"No container registry associated with Azure sandbox group '{sandboxResource.Name}'. This should have been added automatically.");
                var containerRegistry = (ContainerRegistryService)registry.AddAsExistingResource(infrastructure);
                infrastructure.Add(containerRegistry);
                var pullRoleAssignment = containerRegistry.CreateRoleAssignment(
                    ContainerRegistryBuiltInRole.AcrPull,
                    newImagePullIdentity);
                // Azure.Provisioning does not currently generate a stable role-assignment name.
                // See https://github.com/Azure/azure-sdk-for-net/issues/47265.
                pullRoleAssignment.Name = BicepFunction.CreateGuid(
                    containerRegistry.Id,
                    newImagePullIdentity.Id,
                    pullRoleAssignment.RoleDefinitionId);
                infrastructure.Add(pullRoleAssignment);
            }

            infrastructure.Add(new ProvisioningOutput("id", typeof(string)) { Value = sandboxGroup.Id.ToBicepExpression() });
            infrastructure.Add(new ProvisioningOutput("name", typeof(string)) { Value = sandboxGroup.Name.ToBicepExpression() });
            infrastructure.Add(new ProvisioningOutput("location", typeof(string)) { Value = sandboxGroup.Location.ToBicepExpression() });
            infrastructure.Add(new ProvisioningOutput(AzureSandboxGroupResource.ImagePullIdentityClientIdOutputName, typeof(string))

View on GitHub (pinned to 25830f84bd)