Registry Retention Policy (Azure)
CostLens flags Azure Container Registries with no retention/cleanup policy, where untagged and old image layers accumulate storage beyond the included quota.
CostLens flags Azure Container Registries with no retention policy. Without one, every pushed layer is kept forever — untagged and stale images accumulate storage beyond the SKU's included quota. Purging them (or enabling a retention policy) cuts the storage overage charge.
How it works
Registries are enumerated
CostLens lists container registries via the Azure Resource Manager API and checks each one's retention-policy status.
Storage is read from Monitor
The registry's StorageUsed metric gives its total size; the SKU's included quota (Basic 10 GB / Standard 100 GB / Premium 500 GB) is subtracted.
Savings are estimated
Priced as the overage GB × per-GB rate × a conservative cleanup fraction (untagged/stale layers).
What to do
- On Premium registries, enable a retention policy (untagged manifests deleted after N days) — Registry → Retention.
- On Basic/Standard, run
az acr repositorypurges (or an ACR task on a schedule) to delete untagged manifests and old tags.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required permissions
- Detect:
Reader(registry metadata + Monitor metrics) — see Azure Accounts.
Limitations
- Only registries whose storage exceeds the included quota are flagged (below it, there's no overage to save).
- The savings figure is an estimate — actual savings depend on how much is genuinely untagged/stale.