Bicep / Container App Image field fails on format check

[mcrio]

This issue is a: (mark with an x)

• [ x] bug report -> please search issues before submitting
• documentation issue or request
• regression (a behavior that used to work and stopped in a new release)

Issue description

• Using Bicep to deploy a container app
• properties::template::containers::image is dynamically constructed using value from myContainerRegistry.properties.loginServer
• Failure: Container image value is not accepted due to invalid format

I believe during the initial check Bicep does not resolve the properties to a string value so the image input parameter validation fails. This particular check should probably not be part of the initial validation.

loginServer value is used as autoGeneratedDomainNameLabelScope is set for the container registry so the FQDN has a suffix added to the registry name which we do not know before the resource is deployed.

Steps to reproduce

param imageRepositoryName string
param imageTag string

resource containerRegistry 'Microsoft.ContainerRegistry/registries@2026-01-01-preview' existing = {
  name: name
}

resource containerApp 'Microsoft.App/containerApps@2025-10-02-preview' = {
...
properties: {
  template: {
    containers: {
      image: '${containerRegistry.properties.loginServer)/${imageRepositoryName}:${imageTag}'
    }
  }
}
}

Expected behavior
Image value dynamically constructed using container registry property is accepted.

Actual behavior
Fails with formatting error:

Container with name '***' has an invalid image format '[format('{0}/{1}:{2}', reference('/subscriptions/***/resourceGroups/**/providers/Microsoft.ContainerRegistry/registries/***', '2026-01-01-preview').loginServer, '***', '***')]'. Image must match format [registry/]repository[:tag][@digest].

Additional context

Bicep deployment.

[simonjj]

This is a known limitation in the ARM preflight validation — when the image field is constructed dynamically using reference() (e.g., from containerRegistry.properties.loginServer), the validator sees the unexpanded expression and rejects it as an invalid image format.

This is an ARM-level issue rather than a Container Apps issue specifically — the format validation runs before the template expressions are resolved.

Workaround: Use a module output or existing resource reference to resolve the login server into a variable first, or use dependsOn with a separate module that outputs the resolved FQDN.

Routing to the ARM/Bicep team for evaluation.

[mcrio]

Workaround: Use a module output or existing resource reference to resolve the login server into a variable first, or use dependsOn with a separate module that outputs the resolved FQDN.

Hi @simonjj I forgot to mention that I am using modules and output values, but the problem persists as the module output is not resolved to a value but it remains a reference() invocation.