Plan and manage an Azure AI solution 1.2 Set up AI solutions in Foundry

A developer builds a hosted agent's container image on an ARM-based Apple Silicon Mac…

Study guide skill: Configure model and agent deployments

Question B6-007

A developer builds a hosted agent's container image on an ARM-based Apple Silicon Mac, pushes it to Azure Container Registry, and creates an agent version. The agent doesn't run on the hosted agent platform. What should the developer do first?

Select one answer.

  • A Switch the container from the Responses protocol to the Invocations protocol
  • B Retag the same image as :latest and create a new agent version
  • C Rebuild the image for linux/amd64 (for example, docker build --platform linux/amd64 .) and push it again ✓ Correct answer
  • D Assign the Container Registry Repository Reader role on the registry to the developer's own user account

Answer: C

The hosting platform requires x86_64 (linux/amd64) images, and building on Apple Silicon or other ARM machines produces an incompatible ARM image unless you pass --platform linux/amd64. The docs recommend unique image tags instead of :latest. The Container Registry Repository Reader role is for the project's managed identity to pull images, and the Invocations protocol is for webhooks and non-OpenAI payloads, so neither fixes the architecture mismatch.

Deep dive

How it works

The hosted agent platform runs x86_64 (linux/amd64) container images. An Apple Silicon Mac is ARM-based, and a plain docker build on it produces an ARM image the platform can't run. Microsoft's guidance is direct: if you build on Apple Silicon or other ARM-based machines, pass --platform linux/amd64, for example docker build --platform linux/amd64 -t myagent:v1 ., then push the image to Azure Container Registry again.

Two related setup points from the same page:

  • The project managed identity needs the Container Registry Repository Reader role on the registry so the platform can pull images. If you use azd or the VS Code extension, the tooling handles that assignment for you.
  • Use unique image tags instead of :latest for reproducible deployments.

The other options, and when you'd use them

  • Switch to the Invocations protocol: The protocol defines how callers talk to your container. Invocations is for cases such as webhook receivers, non-conversational processing and custom async workflows. It doesn't change the CPU architecture of the image.
  • Retag as :latest: Same image, same architecture, and Microsoft recommends unique tags instead of :latest.
  • Give Repository Reader to your own user: Image pulls are done by the project managed identity, so that's who needs the role. And a permission change wouldn't fix an ARM image.

Exam tip

Hosted agent image built on a Mac (ARM) won't run: rebuild with --platform linux/amd64. Pull permission = project managed identity + Container Registry Repository Reader.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!