Running Bicep Deployment Script Privately Over a Private Endpoint with Custom Image from Private Registry

Question

We are working on using deployment scripts on a private network and need to use a custom container image. The image is stored in a private registry, and we would like to pull additional modules or dependencies from JFrog Artifactory (or another private registry) during the execution of the script. Is that even possible? Has someone come across such a situation?

Following the guide - Run Bicep deployment script privately over a private endpoint

Is it possible to configure the ACI to:

1. Pull a custom image from a private container registry.
2. Pull additional modules or dependencies from JFrog Artifactory (or any private registry) within the container?

If so, could you provide guidance on how to authenticate the container instance to access the JFrog Artifactory registry or another private registry, and how to configure the image to pull the required modules during execution?

Additional Information:

1. We are using deployment scripts in Azure + using bicep.
2. We need to ensure that the custom image can pull modules from private registries like JFrog or similar.
3. If possible, please provide the steps to authenticate and configure the container instance to interact with private registries.

Thank you for any help or guidance!

Example code

resource mngId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
  name: 'xxxx'
  scope: resourceGroup(subId,usmiRG) //if MI in different RG than template deployment target RG
}

resource vnet 'Microsoft.Network/virtualNetworks@2021-05-01' existing = {
  name: vnetName
  scope: resourceGroup(subId, vnetRg)
}

resource containerInstanceSubnet 'Microsoft.Network/virtualNetworks/subnets@2021-05-01' existing = {
  name: subnetName
  parent: vnet
}

resource Script 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
  name: 'scriptTestsi'
  location: location
  kind: 'AzurePowerShell'
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${mngId.id}': {}
    }
  }
  properties: {
    azPowerShellVersion: '5.0'
    scriptContent: '''
Param([string] $StorageAccountName)
Connect-AzAccount -Identity
$DeploymentScriptOutputs["output"] = New-AzStorageContext -UseConnectedAccount -StorageAccountName $StorageAccountName `
    | Get-AzStorageBlob -Container 'images' -Blob * | Out-String
'''
    arguments: '-StorageAccountName ${storageAccountName}'
    cleanupPreference: 'OnSuccess' //when to cleanup the storage account and ACI instance or OnExpiration, Always
    retentionInterval: 'PT4H' //keep the deployment script resource for this duration (ISO 8601 format) and ACI/SA if OnExpiration cleanuppreference
    forceUpdateTag: currentTime // ensures script runs every time
    storageAccountSettings: {
      storageAccountName: storageAccountName
      storageAccountKey: listKeys(resourceId('Microsoft.Storage/storageAccounts', storageAccountName), '2019-06-01').keys[0].value
    }
    containerSettings: {
      containerGroupName: 'mycustomaci-1'
      subnetIds: [
        {
          id: containerInstanceSubnet.id
        }
      ]
    }
  }
}


output scriptOutput string = Script.properties.outputs.output
//output scriptLogs string = reference('${dScript.id}/logs/default', dScript.apiVersion, 'Full').properties.log