You need to run a one-off data migration container with access to the app's secrets, exactly once. What is the cleanest option?

1. ✓ A A Container Apps Job with a manual trigger and replicaCompletionCount 1 (correct answer)
2. B Scaling the main app to 2 replicas temporarily
3. C A cron scale rule
4. D An init container on the main app

Shortcut: A manually triggered Job runs to completion once, can reference the same secrets and identity, and terminates without affecting the serving app.