Hey People!
You probably have ever stood up a market Ubuntu VM, SSH’d in, layered in your monitoring agent, safety tooling, a few CA certs, and a hardening script, then captured the consequence and known as it your “golden picture,” I’ve dangerous information. That picture was already drifting from the subsequent one your coworker constructed earlier than you completed naming the snapshot. On the Microsoft Azure Infra Summit 2026, Sandeep Raichura (PM for Azure Compute Gallery) and Kofi Forsen (PM for Azure VM Picture Builder) rebuilt the entire workflow the correct approach. Supply, customise, validate, distribute, deploy. No clicks. No tribal information. No 2 AM heroics.
📺 Watch the session:
You carry the pager when a nasty picture rolls into ten areas. You clarify why three groups have three completely different Ubuntu 22.04 baselines with three completely different brokers. You discover out at 2 AM that somebody deleted “the previous picture” and the previous picture was the one manufacturing VMSS was nonetheless pulling.
This session is in your lane. It covers:
- Why hand-rolled pictures cease working the second a second workforce wants one.
- How Azure VM Picture Builder (AIB) turns picture creation into declarative pipeline code.
- How Azure Compute Gallery handles versioning, replication, sharing, and accidental-deletion safety.
- How computerized picture creation triggers chain a market replace by means of your golden picture, into each downstream picture, with zero handbook steps.
- How VM Scale Units shut the loop with rolling upgrades and computerized OS improve.
Briefly, that is the practitioner model of “do VM picture administration correctly,” from the PMs who personal each providers.
The 2 providers do completely different jobs and you actually do want each.
Azure VM Picture Builder is the construct engine. You hand it a JSON template that declares:
- A supply (market picture, managed picture, VHD, or current gallery model).
- Customizers (shell, PowerShell, Home windows updates, file copies, restart steps).
- A number of distribute targets (often a Compute Gallery picture definition).
AIB spins up a brief construct VM, runs your customizers so as, validates, generalizes, captures, and publishes. Each construct runs the very same approach. No SSH, no RDP, no “I forgot to put in the monitoring agent this time.”
Azure Compute Gallery is the administration layer for the ensuing artifacts. Previously Shared Picture Gallery, it has three ranges:
- Gallery. The highest-level container. Sharing coverage lives right here: RBAC, Direct Shared Gallery, or Group Gallery.
- Picture definition. The metadata. OS sort, era, safety sort, writer / provide / SKU. The SKU of a picture household.
- Picture model. The precise replicated artifact. Controls areas, reproduction counts, storage sort (ZRS by default), end-of-life date, and the security flags.
AIB writes the artifact. Compute Gallery shops, variations, replicates, and shares it.
The session walked by means of the 5 steps an actual pipeline wants, with no handbook intervention within the crucial path:
- Supply. A market picture or some other base.
- Customise. Scripts that set up brokers, harden, configure, and validate. Saved in a storage account so AIB can pull them with the correct managed id.
- Validate. Constructed-in validation hooks plus your individual smoke checks baked into the customizer. Fail quick. Don’t silently proceed.
- Distribute. Push the captured picture to a Compute Gallery picture definition. Decide your areas and reproduction counts right here.
- Model. Compute Gallery handles semantic versioning, replication, and security flags.
The trick that makes this an actual pipeline is the two-template sample Kofi demoed:
- A supply template builds the org-wide golden picture from {the marketplace} base. Its supply reference is about to newest for {the marketplace} SKU (for instance, Canonical Ubuntu 22.04 newest).
- A distro template layers user-group-specific tooling on high of the golden picture. Its supply reference is the golden picture gallery model, additionally set to newest.
Each templates get an computerized picture creation set off connected. Triggers solely fireplace when the template references newest. From that time on:
- Canonical publishes a brand new Ubuntu 22.04. The supply template’s set off fires, AIB rebuilds your golden picture, and a brand new model lands within the supply gallery.
- That new golden picture model fires the distro template’s set off. AIB rebuilds each downstream distro picture robotically.
- VM Scale Units configured for computerized OS improve choose up the brand new picture model and roll it out in batches, pausing if the Utility Well being probe goes crimson.
You set it up as soon as. After that you just solely come again once you need to change one thing on goal.
A foul picture on the high of this chain takes out 1000’s of VMs on the backside. Sandeep was clear: security shouldn’t be optionally available, it’s in-built. The 4 options price turning on each time:
- ZRS storage by default. Picture variations saved on zone-redundant storage so a zonal failure doesn’t take the picture down.
- Exclude from newest. Stage a picture right into a area with out making it the default for brand spanking new deployments. Flip the flag when you find yourself able to roll. You possibly can set this globally on the model or per area.
- Block deletion earlier than end-of-life. The picture can’t be deleted till its end-of-life date. That is the flag that stops the two AM unintentional delete.
- Smooth delete. If every part else fails, mushy delete provides you a restoration window to revive a picture model that ought to not have been eliminated.
Mix these 4 with a sane end-of-life date on each model and your blast radius drops dramatically.
Just a few patterns that got here up within the session and the Q&A:
- Multi-region fleets. Outline your goal areas within the AIB template. AIB arms the artifact to Compute Gallery and Compute Gallery does the replication. Your scale units in each area pull a neighborhood reproduction, not a cross-region copy.
- Open-source writer. Use a Group Gallery so anybody in Azure can deploy your picture. You present a contact URL and e-mail on the gallery stage so customers know the place to file points.
- Accomplice sharing. Use Direct Shared Gallery to grant particular subscriptions or tenants entry with out making the picture public.
- VM Scale Units with rolling improve. Reference the picture definition (not a particular model) once you create the size set. The size set tracks newest. Pair it with a rolling improve coverage and the Utility Well being extension. AIB publishes, Compute Gallery replicates, the size set rolls, and the rollout pauses itself if the Utility Well being probe goes crimson.
Decide the highest-pain merchandise and begin there. You do not need to do that .
- Get up a Compute Gallery in a single area. Create one picture definition with correct writer / provide / SKU metadata. Activate mushy delete on the gallery.
- Wrap an current construct script in an AIB picture template. Use a market picture because the supply. Distribute to your new gallery.
- Add excludeFromLatest, endOfLifeDate, and the block-deletion flags to your picture model. Default to ZRS storage.
- Register the Microsoft.VirtualMachineImages and the triggers characteristic. Connect an computerized picture creation set off to the template. Set the supply reference to newest.
- Construct a second template that takes your golden picture as its supply. Connect a set off to that one too.
- Create a VM Scale Set that references the picture definition and allow computerized OS improve with rolling upgrades and the Utility Well being extension.
That’s the loop. Supply updates circulation by means of robotically. Unhealthy pictures don’t delete one another. Fleets roll ahead in batches.
- Azure VM Picture Builder overview. The service ideas, supported OS, areas, and capabilities.
- Azure Compute Gallery overview. Gallery, definition, model, replication, and sharing.
- Azure VM Picture Builder greatest practices. Id, networking, customizers, and operational steerage from the product workforce.
- Computerized Picture Creation with Picture Builder triggers. Step-by-step to wire up source-image triggers.
- Create a picture definition and picture model. Portal, CLI, PowerShell, and REST flows for publishing artifacts.
- Computerized OS picture upgrades for VM Scale Units. The closing leg of the pipeline.
- Share pictures utilizing Group Gallery. Public, non-commercial sharing for open-source publishers.
- Azure Picture Builder samples on GitHub. Reference templates, customization scripts, and end-to-end examples.
This session was one in every of many on the Microsoft Azure Infrastructure Summit 2026. If you would like the keynotes, the IaC deep dives, the AKS classes, and the remainder of the infra monitor, the total playlist is right here:
Microsoft Azure Infra Summit 2026 playlist
Cheers!
Pierre Roman
