Ship your app.
Get a URL.
Drop a folder with a Dockerfile into the repo, merge your PR, and your app is live on HTTPS — no pipeline to run by hand. Want a nice domain like yourapp.orea.cz? Ask the service desk.
Add your app
Copy the template folder in the repo and drop in your Dockerfile.
Merge your PR
app-deploy queues itself automatically and builds/deploys to prod — nothing to run by hand.
It's live
Reachable on its default azurecontainerapps.io URL with HTTPS.
Custom domain
Request yourapp.orea.cz via the service desk.
Live
What's deployed right now.
Pulled straight from every app's own app-deploy run — nobody maintains this list by hand, and it's only as current as the last deploy.
Deploy your app
Three steps, all self-service.
Everything your app needs lives in one folder in the sharedapps-prod-01 repo. No infrastructure to set up — the first deploy creates everything your app needs on its own.
Work on a branch, not on main. Create your own branch, push your changes, and open a pull request — direct commits to main are turned off, so every change gets a quick review and main stays deployable.
Add your app folder
In the repo, copy apps/_template to apps/<your-app> and put your real Dockerfile there. It just has to listen on the port you set as targetPort.
Fill in a few parameters
Edit containerapp.bicepparam in your folder — the repository name (same as the folder), the port, and how much CPU/memory it gets. Your Container App's own name is computed automatically as ca-<repositoryName>-<environment>, nothing to set. Add Key Vault secret references only if your app needs them. Set appOwnerUpn to your email to get Contributor on your app's resource group, and applicationName / appDescription to label it.
param repositoryName = 'my-app' // = your folder name
param targetPort = 8080
param cpu = '0.5'
param memory = '1Gi'
param environmentVariables = []
// your secrets, by name - read from your app's own Key Vault
param appKeyVaultSecrets = []
// who gets Contributor on this app's resource group
param appOwnerUpn = 'jan.novak@cimex.cz'
// shown as tags on the resource group
param applicationName = 'My App'
param appDescription = 'What it does'Open a PR and merge it
That's it — merging to main automatically queues app-deploy for your app, targeting prod. It builds your image and deploys it, still gated by a platform-team approval before it actually goes live; your app comes up on its own HTTPS URL, no pipeline to run by hand. Want to try something out first without any of that? See "Push to dev/ or test/" below.
Custom domain
Want yourapp.orea.cz? Add it yourself.
Your app already has a working HTTPS URL out of the box. A friendlier one under orea.cz or cimex.cz is part of your own app folder now — edit custom-domains.json and open a PR, same as any other change (still reviewed - see "Who can change what" in the repo docs).
[
{
"targetEnvironment": "prod",
"domains": ["app.example.com"]
}
]Ask the service desk to run it
Once your PR is merged, go to servicedesk.cimex.cz and ask for frontdoor-deploy to be run for your app — that part stays platform-team only. You don't need to describe the domain again, it's already in the file you merged.
Tell us
- App name — the folder whose custom-domains.json you just merged
What happens
- The platform team runs frontdoor-deploy for your app
- DNS and a managed TLS certificate are provisioned automatically
- The certificate can take up to ~1 hour to go live after setup
You already wrote the config — this step just applies it.
Open the service desk ↗Good to know
A few things that'll help.
Two environments
prod is the real one, and the default — merging your PR deploys there automatically. test is the instant no-review fast lane (see below), for trying things out.
HTTPS is included
Every app gets a valid HTTPS URL automatically, on both its default domain and any custom domain.
Your own Key Vault, by default
Every app gets its own dedicated Key Vault (createAppKeyVault, on by default) — only your app can read it. Add your secrets there, then list them by name in appKeyVaultSecrets; the right vault for each environment is worked out for you.
Your own space
Each app gets its own resource group — rg-app-<app-name>-<environment>, e.g. rg-app-my-app-prod — and identity, created on first deploy. That's where to find it in the portal. Set appOwnerUpn and you get Contributor on it; applicationName / appDescription show up as tags on the group.
Scales to zero-ish
Set minReplicas/maxReplicas in your parameters. Small apps stay small and cheap.
Stuck?
Check the pipeline logs first — they say what failed. For anything platform-side, reach the platform team via the service desk.
Push to dev/ or test/ for an instant deploy
Push straight to a dev/<anything> or test/<anything> branch and your app builds and deploys to test within seconds — no PR, no approval. That's also the catch: it's fast because it skips review entirely, running with the same pipeline identity as everywhere else. Treat it as a trusted-users-only fast lane, not a safe sandbox for code you don't trust. It has its own resource group/ACR/Key Vault, isolated from prod — but not from what a deploy itself is allowed to do.
This page is proof
sharedapps-web — the page you're reading right now — is deployed through the exact same app-deploy pipeline as every other app on this platform, no special-casing. Check the "live" section above and you'll find it listed as just another app.
What's new
Platform news.
Infra and pipeline changes worth knowing about — not routine app deploys, those are already in "Live" above.