microsoft/aspire · error · InvalidOperationException

No container registry associated with Azure sandbox group

Error message

No container registry associated with Azure sandbox group '{Name}'. This should have been added automatically.

What it means

During publish-mode preparation, the sandbox group needs a container registry to which compute resources' images are pushed. The registry is normally added automatically when the sandbox group is created, so finding none indicates the internal registration was lost (e.g. a user-supplied registry reference annotation removed the default without providing a replacement, or the model was mutated).

Solutions

  1. Ensure the publish pipeline includes a container registry resource for the sandbox group (let Aspire create the default one, or set ContainerRegistry to an existing Azure Container Registry resource).
  2. If using a custom registry via ContainerRegistryReferenceAnnotation, verify the referenced registry resource is actually present in the model before publishing.
  3. Remove any code that manually removes DefaultContainerRegistry or the registry resource from the application model.
  4. Update the Aspire.Hosting.Azure.Sandboxes package if you suspect the automatic registry addition silently failed in an earlier version.

Example fix

// before (custom publish pipeline removing the default registry)
model.Resources.Remove(sandboxGroup.DefaultContainerRegistry);

// after (supply an explicit registry instead)
sandboxGroup.ContainerRegistry = existingAcr;
Defensive patterns

Strategy: validation

Validate before calling

if (sandboxGroup.ContainerRegistry is null)
{
    throw new InvalidOperationException("Sandbox group has no container registry; set ContainerRegistry or remove custom registry-reference handling before publishing.");
}

Try / catch

try { await pipeline.PublishAsync(...); } catch (InvalidOperationException ex) when (ex.Message.Contains("No container registry associated with Azure sandbox group")) { /* attach a registry resource and retry publish */ }

Prevention

When it happens

Trigger: Publishing an app model containing an AzureSandboxGroupResource when resource.ContainerRegistry is null at PrepareDeploymentTargetsAsync time — typically after a ContainerRegistryReferenceAnnotation caused DefaultContainerRegistry to be removed without an explicit registry being set, or custom model mutation removed the registry resource.

Common situations: Publishing with a custom registry-reference annotation but no actual registry resource; manually removing the auto-created DefaultContainerRegistry from the model in a customizer; a bug or early version where the automatic registry hookup did not run before deployment-target preparation.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/8ca2b36d8ab26a15. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs:198

            context.CancellationToken).ConfigureAwait(false);
    }

    private async Task PrepareDeploymentTargetsAsync(PipelineStepContext context)
    {
        if (!context.ExecutionContext.IsPublishMode)
        {
            return;
        }

        if (this.HasAnnotationOfType<ContainerRegistryReferenceAnnotation>() &&
            DefaultContainerRegistry is not null)
        {
            context.Model.Resources.Remove(DefaultContainerRegistry);
            DefaultContainerRegistry = null;
        }

        var containerRegistry = ContainerRegistry ??
            throw new InvalidOperationException($"No container registry associated with Azure sandbox group '{Name}'. This should have been added automatically.");
        var imagePullIdentity = this.TryGetLastAnnotation<AzureSandboxGroupAcrPullIdentityAnnotation>(out var imagePullIdentityAnnotation)
            ? imagePullIdentityAnnotation.Identity
            : null;

        if (imagePullIdentity is not null && WorkloadUserAssignedIdentities.Contains(imagePullIdentity))
        {
            throw new InvalidOperationException(
                $"Azure sandbox group '{Name}' uses identity '{imagePullIdentity.Name}' for both image pulls and workloads. " +
                "Use a dedicated image-pull identity so its AcrPull permission is not exposed to sandbox workloads.");
        }

        var computeEnvironments = context.Model.Resources.OfType<IComputeEnvironmentResource>().ToList();
        var canClaimUnassignedComputeResources = computeEnvironments.Count == 1 && ReferenceEquals(computeEnvironments[0], this);

        foreach (var resource in context.Model.GetComputeResources())
        {
            var resourceComputeEnvironment = resource.GetComputeEnvironment();
            if (resourceComputeEnvironment is null && !canClaimUnassignedComputeResources)

View on GitHub (pinned to 25830f84bd)