Container registry security: disable the admin user, RBAC pull/push roles, private endpoints, image vulnerability scanning

Azure Container Registry (ACR) stores the container images that AKS, App Service, Container Apps and other services run. If an attacker can push to your registry, they can plant a malicious image that your clusters will happily deploy; if they can pull, they may find secrets or proprietary code inside images. So registry security is part of the software supply chain.