Azure Container Apps in a VNet, Exposed to the Internet
A step-by-step production guide: an internal-only Container Apps environment published through Application Gateway with WAF.
Run the Container Apps environment in internal-only mode inside a VNet, pull images from ACR over a private endpoint with a managed identity, and publish the app through Application Gateway WAF v2. A private DNS zone named after the environment's default domain lets the gateway resolve the app.