title: Can docker on Azure Linux App Service authenticate with the ACR without us specifying the password in the app settings?
body: <p>We deploy a Linux App Service to Azure using terraform. The relevant configuration code is:</p>
  
  <pre><code>resource "azurerm_app_service" "webapp" {
    app_settings = {
      DOCKER_REGISTRY_SERVER_URL              = "https://${local.ctx.AcrName}.azurecr.io"
      DOCKER_REGISTRY_SERVER_USERNAME         = data.azurerm_key_vault_secret.acr_admin_user.value
      DOCKER_REGISTRY_SERVER_PASSWORD         = data.azurerm_key_vault_secret.acr_admin_password.value
      ...
    }
    ...
  }
  </code></pre>
  
  <p>The problem is that terraform does not consider <code>app_settings</code> a secret and so it outputs in the clear the <code>DOCKER_REGISTRY_SERVER_PASSWORD</code> value in the Azure DevOps output (I obfuscated the actual values):
  <a href="https://i.stack.imgur.com/Fi1L6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fi1L6.png" alt="enter image description here"></a></p>
  
  <p>So, I am wondering - can docker running on an Azure Linux App Service host authenticate with the respective ACR without us having to pass the password in a way that makes it so obvious to every one who can inspect the pipeline output?</p>
  
  <p>The following article seems relevant in general - <a href="https://docs.docker.com/engine/reference/commandline/login" rel="nofollow noreferrer">https://docs.docker.com/engine/reference/commandline/login</a>, but it is unclear how we can apply it in my context, if at all.</p>
  
  <p>Also, according to <a href="https://feedback.azure.com/forums/169385-web-apps/suggestions/36145444-web-app-for-containers-acr-access-requires-admin#%7Btoggle_previous_statuses%7D" rel="nofollow noreferrer">https://feedback.azure.com/forums/169385-web-apps/suggestions/36145444-web-app-for-containers-acr-access-requires-admin#%7Btoggle_previous_statuses%7D</a> Microsoft has started working on something relevant, but looks like this is still a work in progress (almost 5 months).</p>