How to deploy ASP.NET 6/Cosmos web apps with secrets via docker hub to Azure App Service?

Question

Holiday greetings to all!

I have questions about running my github fork of PlanetaryDocs on Azure App Service. This is a sample serverside Blazor ASP.NET 6/Entity Framework/Cosmos/DocumentDB demo.

1. Is this the the appropriate forum for questions on Azure App Service? I was looking at azure forums list and could not find "Azure App Service" and was not familiar with the term "Azure Web Apps".
2. I was able to deploy my docker container of planetary docs via Azure container Registry (but had some trouble). Since I don't have any funding for my project yet, I'm hoping ACR is pretty inexpensive for my little demo apps. I would prefer to use DockerHub because that is free. Is it possible to deploy my Docker Containers from DockerHub (instead of ACR) to Azure App Service? I'm surprised because I can use Docker Hub for Azure Kubernetes but (so far) not for App Service. Strange!
3. Can someone show me the Azure CLI commands for deploying my docker container from ACR and/or Dockerhub to App Service so I can keep my CosmosDB account and endpoint secret? When I deploy my prototype apps to Azure Kubernetes (AKS), I store my secrets in environment variables on my dev machine so that when I execute my Kubernetes deployment YAML (which contains references to those same environment variable names), the values are passed to the newly created Kubernetes POD without having stored the values in the Docker container. Can I do something similar using the Azure CLI (or bicep or ARM) for the App Service deployments? I see Jordan's nice article recommends Azure Key Vault (AKV). While I have used AKV in in AKS, my method is a lot simpler (I don't have to configure AKV) and calling the C# function Environment.GetEnvironmentVariable is really simple. Is it secure with Kubernetes? Is it possible to do with App Service? Would it be secure with App Service (assuming it is possible)?

Thanks
Siegfried

Sat Jan 08 2021 Update:

Progress: Since I was having trouble I temporarily abandoned docker containers and github/dockerhub/ACR and deployed a simple ASP.NET MVC "hello World" app from my local source code with Visual Studio 2022 and was able to make this work

 az.cmd webapp config appsettings set  --resource-group rg_helloMCVAppService  --name webapphelloMVCAppService  --settings CONTENT_PIPELINE_MSSQL=CONNECTION_STRING_GOES_HERE  

After stopping and starting the App Service web app, the home controller successfully demonstrated translating the environment variable...

New question: I could not make following command work with all the troublesome equal signs, parens and slashes.

az.cmd webapp config appsettings set  --resource-group rg_helloMCVAppService  --name webapphelloMVCAppService  --settings CONTENT_PIPELINE_MSSQL=Server\=\(localdb\)\\MSSQLLocalDB\;Database=ContentPipeline\;MultipleActiveResultSets=True\;Persist\ Security Info=True\;Integrated\ Security=True  

While I am not specifically interested in using localdb on my webapp, I would like to know how to include these trouble special characters in my environment variables... I got this command to work in Powershell finanlly... How would I make it work in CMD.EXE or WSL2/ubuntu/bash or cygwin bash?

Ok, next I will try again with a DOCKER container!

Mon Jan 10 2022 Update:

Problem solved! Because there were no examples I could find to follow and the Visual Studio 2022 GUI does not support publishing to App Service with a docker container I had forgotten to specify the --deployment-container-image-name on the create command... Why did it not give me an error!

So including this on the command line azure cli command line for "az.cmd webapp create" solved the problem.

Answer 1

1- Please remove the azure-kubernetes-service tag.

2- Yes, you can use images from public and private Docker Hub registries.

az webapp create -g MyResourceGroup -p MyPlan -n MyUniqueAppName -i nginx

3- Set your secrets as Application Settings. They will be injected as environment variables in your container.

az webapp config appsettings set -g MyResourceGroup -n MyUniqueApp --settings KEY=VALUE