Skip to main content
idle · azure

Container registries with no image pulls and no pushes for 30 days

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

A container registry with zero pulls means no deployment consumes its images, and zero pushes means no pipeline still feeds it. ZopNight requires both TotalPullCount and TotalPushCount to average below 1 across 30 full days of data before flagging the registry, whose Basic/Standard/Premium tiers bill roughly $5/$20/$50 monthly regardless.

Signal and threshold

How ZopNight evaluates Container registries with no image pulls and no pushes for 30 days.
Field Value
Rule IDsRC-1371
Categoryidle
Severitylow
Metricnone — pure configuration read
Sourcecontainer_registry_idle.go

Pushes prove a pipeline, pulls prove consumers

Deleting a registry that a CI pipeline still pushes to breaks the next build even if nothing pulls the images yet. So this rule checks two directions independently: TotalPullCount below its floor means no deployment is consuming images, and TotalPushCount below its floor means no build is feeding the registry. Either side showing activity vetoes the finding: an active build target is not an orphan, it is a registry mid-adoption.

A floor of 1, not a strict zero

Both counters must average below 1.0. Registries register trivial noise (a manual docker pull during debugging, a health probe, the monitoring agent), and a strict equals-zero test would let a single stray datapoint shield a genuinely dead registry forever. The sub-1 floor admits that baseline while excluding any real pull or push. These are sum-style metrics, so the decision reads averaged daily totals; there is no peak band to consult.

Thirty days of coverage on both counters

Each series must span 30 full days before its zeros are trusted, which protects registries that were just created or just started reporting metrics. Deploy cadences are often monthly, and the window is sized to see one full cycle.

Confirm with one command

Terminal window
az monitor metrics list \
--resource "$(az acr show -n <registry> --query id -o tsv)" \
--metric TotalPullCount TotalPushCount \
--interval P1D --offset 30d --aggregation Total

What makes ZopNight hold back

Absent metrics, under 30 days of history on either counter, any pull or push activity, or a missing priced cost each independently suppress the recommendation. The registry fee is fixed per tier, roughly $5 a month on Basic, $20 on Standard, $50 on Premium, so the priced saving is the tier fee itself.

Cleanup with an exit ramp

Before deleting, list repositories and export any image worth keeping (az acr repository list). If the registry is Premium mostly for storage headroom it no longer needs, a downgrade to Basic captures most of the saving without deleting anything. Detection needs Reader and Monitoring Reader only.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·