Hiya People!
When you have ever stood up a market Ubuntu VM, SSH’d in, layered in your monitoring agent, safety tooling, a few CA certs, and a hardening script, then captured the outcome and known as it your “golden picture,” I’ve dangerous information. That picture was already drifting from the subsequent one your coworker constructed earlier than you completed naming the snapshot. On the Microsoft Azure Infra Summit 2026, Sandeep Raichura (PM for Azure Compute Gallery) and Kofi Forsen (PM for Azure VM Picture Builder) rebuilt the entire workflow the suitable manner. Supply, customise, validate, distribute, deploy. No clicks. No tribal information. No 2 AM heroics.
📺 Watch the session:
You carry the pager when a foul picture rolls into ten areas. You clarify why three groups have three completely different Ubuntu 22.04 baselines with three completely different brokers. You discover out at 2 AM that somebody deleted “the previous picture” and the previous picture was the one manufacturing VMSS was nonetheless pulling.
This session is in your lane. It covers:
- Why hand-rolled photos cease working the second a second group wants one.
- How Azure VM Picture Builder (AIB) turns picture creation into declarative pipeline code.
- How Azure Compute Gallery handles versioning, replication, sharing, and accidental-deletion safety.
- How computerized picture creation triggers chain a market replace by your golden picture, into each downstream picture, with zero handbook steps.
- How VM Scale Units shut the loop with rolling upgrades and computerized OS improve.
Briefly, that is the practitioner model of “do VM picture administration correctly,” from the PMs who personal each companies.
The 2 companies do completely different jobs and you actually do want each.
Azure VM Picture Builder is the construct engine. You hand it a JSON template that declares:
- A supply (market picture, managed picture, VHD, or present gallery model).
- Customizers (shell, PowerShell, Home windows updates, file copies, restart steps).
- A number of distribute targets (normally a Compute Gallery picture definition).
AIB spins up a short lived construct VM, runs your customizers so as, validates, generalizes, captures, and publishes. Each construct runs the very same manner. No SSH, no RDP, no “I forgot to put in the monitoring agent this time.”
Azure Compute Gallery is the administration layer for the ensuing artifacts. Previously Shared Picture Gallery, it has three ranges:
- Gallery. The highest-level container. Sharing coverage lives right here: RBAC, Direct Shared Gallery, or Group Gallery.
- Picture definition. The metadata. OS sort, technology, safety sort, writer / supply / SKU. The SKU of a picture household.
- Picture model. The precise replicated artifact. Controls areas, duplicate counts, storage sort (ZRS by default), end-of-life date, and the protection flags.
AIB writes the artifact. Compute Gallery shops, variations, replicates, and shares it.
The session walked by the 5 steps an actual pipeline wants, with no handbook intervention within the important path:
- Supply. A market picture or every other base.
- Customise. Scripts that set up brokers, harden, configure, and validate. Saved in a storage account so AIB can pull them with the suitable managed id.
- Validate. Constructed-in validation hooks plus your individual smoke checks baked into the customizer. Fail quick. Don’t silently proceed.
- Distribute. Push the captured picture to a Compute Gallery picture definition. Decide your areas and duplicate counts right here.
- Model. Compute Gallery handles semantic versioning, replication, and security flags.
The trick that makes this an actual pipeline is the two-template sample Kofi demoed:
- A supply template builds the org-wide golden picture from {the marketplace} base. Its supply reference is ready to newest for {the marketplace} SKU (for instance, Canonical Ubuntu 22.04 newest).
- A distro template layers user-group-specific tooling on prime of the golden picture. Its supply reference is the golden picture gallery model, additionally set to newest.
Each templates get an computerized picture creation set off hooked up. Triggers solely hearth when the template references newest. From that time on:
- Canonical publishes a brand new Ubuntu 22.04. The supply template’s set off fires, AIB rebuilds your golden picture, and a brand new model lands within the supply gallery.
- That new golden picture model fires the distro template’s set off. AIB rebuilds each downstream distro picture routinely.
- VM Scale Units configured for computerized OS improve decide up the brand new picture model and roll it out in batches, pausing if the Software Well being probe goes purple.
You set it up as soon as. After that you simply solely come again once you wish to change one thing on objective.
A nasty picture on the prime of this chain takes out 1000’s of VMs on the backside. Sandeep was clear: security is just not optionally available, it’s in-built. The 4 options price turning on each time:
- ZRS storage by default. Picture variations saved on zone-redundant storage so a zonal failure doesn’t take the picture down.
- Exclude from newest. Stage a picture right into a area with out making it the default for brand new deployments. Flip the flag if you find yourself able to roll. You may set this globally on the model or per area.
- Block deletion earlier than end-of-life. The picture can’t be deleted till its end-of-life date. That is the flag that stops the two AM unintentional delete.
- Smooth delete. If all the pieces else fails, gentle delete offers you a restoration window to revive a picture model that ought to not have been eliminated.
Mix these 4 with a sane end-of-life date on each model and your blast radius drops dramatically.
A couple of patterns that got here up within the session and the Q&A:
- Multi-region fleets. Outline your goal areas within the AIB template. AIB fingers the artifact to Compute Gallery and Compute Gallery does the replication. Your scale units in each area pull a neighborhood duplicate, not a cross-region copy.
- Open-source writer. Use a Group Gallery so anybody in Azure can deploy your picture. You present a contact URL and electronic mail on the gallery degree so customers know the place to file points.
- Associate sharing. Use Direct Shared Gallery to grant particular subscriptions or tenants entry with out making the picture public.
- VM Scale Units with rolling improve. Reference the picture definition (not a particular model) once you create the size set. The dimensions set tracks newest. Pair it with a rolling improve coverage and the Software Well being extension. AIB publishes, Compute Gallery replicates, the size set rolls, and the rollout pauses itself if the Software Well being probe goes purple.
Decide the highest-pain merchandise and begin there. You wouldn’t have to do that abruptly.
- Arise a Compute Gallery in a single area. Create one picture definition with correct writer / supply / SKU metadata. Activate gentle delete on the gallery.
- Wrap an present construct script in an AIB picture template. Use a market picture because the supply. Distribute to your new gallery.
- Add excludeFromLatest, endOfLifeDate, and the block-deletion flags to your picture model. Default to ZRS storage.
- Register the Microsoft.VirtualMachineImages and the triggers function. Connect an computerized picture creation set off to the template. Set the supply reference to newest.
- Construct a second template that takes your golden picture as its supply. Connect a set off to that one too.
- Create a VM Scale Set that references the picture definition and allow computerized OS improve with rolling upgrades and the Software Well being extension.
That’s the loop. Supply updates move by routinely. Unhealthy photos don’t delete one another. Fleets roll ahead in batches.
- Azure VM Picture Builder overview. The service ideas, supported OS, areas, and capabilities.
- Azure Compute Gallery overview. Gallery, definition, model, replication, and sharing.
- Azure VM Picture Builder greatest practices. Identification, networking, customizers, and operational steerage from the product group.
- Computerized Picture Creation with Picture Builder triggers. Step-by-step to wire up source-image triggers.
- Create a picture definition and picture model. Portal, CLI, PowerShell, and REST flows for publishing artifacts.
- Computerized OS picture upgrades for VM Scale Units. The closing leg of the pipeline.
- Share photos utilizing Group Gallery. Public, non-commercial sharing for open-source publishers.
- Azure Picture Builder samples on GitHub. Reference templates, customization scripts, and end-to-end examples.
This session was considered one of many on the Microsoft Azure Infrastructure Summit 2026. If you need the keynotes, the IaC deep dives, the AKS classes, and the remainder of the infra monitor, the complete playlist is right here:
Microsoft Azure Infra Summit 2026 playlist
Cheers!
Pierre Roman
