Enable image sync acceleration-Container Registry(ACR)-阿里云帮助中心

Cross-border synchronization of Container Registry (ACR) images, such as between the Chinese mainland and other regions, can be slow or unreliable over public networks. To address this, ACR offers two solutions: sync acceleration and custom synchronization links.

How it works

Solution

Use cases

Sync method

Network bandwidth

Sync acceleration

When the default sync link is insufficient for your cross-border needs and you have no advanced network requirements.

Images are transmitted over the ACR acceleration link.

The sync acceleration link's bandwidth is shared by all users in a region.

Use a custom synchronization link

The performance of sync acceleration does not meet your latency requirements, or you need advanced customization of the network link.

Two methods are supported:

Synchronize images by using OSS Cross-Region Replication.
This method supports cross-account synchronization.
Transmit images through a Cloud Enterprise Network (CEN) instance that you configure.

OSS Cross-Region Replication: You have dedicated bandwidth for the OSS Cross-Region Replication feature and can increase the bandwidth limit.
Cloud Enterprise Network (CEN): You have dedicated bandwidth for the CEN instance, which can be elastically scaled as needed.

Availability

These solutions apply only to synchronization between public cloud regions. Synchronization to non-public cloud regions, such as Finance Cloud or Gov Cloud, is not supported.
These solutions are available only for the Standard and Premium editions of ACR Enterprise Edition.

Billing

The sync acceleration feature of ACR is free of charge. However, a custom synchronization link may incur costs from other cloud services:

OSS Cross-Region Replication: You are charged for cross-region replication traffic and transfer acceleration traffic. For more information about billing, see Billing overview and Transfer acceleration fees.
Cloud Enterprise Network (CEN): You are charged for connection fees, data processing fees, and cross-region data transfer fees. For more information about billing, see Billing.

Solution 1: Use sync acceleration

Log on to the Container Registry console.
In the top navigation bar, select a region.
In the left-side navigation pane, click Instances.
On the Instances page, click the Enterprise Edition instance that you want to manage.
In the left-side navigation pane, choose Distribution > Instance Replication.
On the Instance Replication page, turn on the Cross-border Replication Acceleration switch in the upper-left corner.
In the Tips dialog box, click Confirm.
After you enable sync acceleration, create a sync rule to replicate images from the source instance to the destination instance. For more information, see Synchronize images between instances in the same account and Synchronize images between instances in different accounts.

Sync acceleration performance reference

The following table shows the P95 latency for synchronizing a 1 GB single-layer image across different regions after enabling sync acceleration in March 2022. This data excludes queuing time from exceeding concurrent task limits. The China (Hangzhou) region is used as the example for the Chinese mainland.

P95 latency represents the 95th percentile, meaning 95% of sync tasks completed at or below this time.

ACR

Solution 2: Use a custom sync link

(Optional) Grant RAM permissions

A RAM user needs the following permissions to use the custom synchronization link feature. For more information, see Create a custom policy for a RAM user.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cr:CreateSyncCustomLink",
                "cr:GetSyncCustomLink",
                "cr:UpdateSyncCustomLink",
                "cr:ListSyncCustomLink",
                "cr:DeleteSyncCustomLink",
                "cr:CreateSyncOssReplicationLink"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

OSS Cross-Region Replication

After you configure a custom synchronization link, ACR automatically creates a Cross-Region Replication rule in the OSS buckets used by the source and destination ACR instances. ACR then leverages the Cross-Region Replication feature of OSS to accelerate image transfers.

Choose an option based on whether you are synchronizing within the same account or across different accounts:

Same-account sync

Log on to the Container Registry console.
In the top navigation bar, select a region.
You must configure the custom synchronization link on the source instance. On the Instances page, click the source instance.
In the left-side navigation pane, choose Distribution > Synchronization Link. Click the OSS Replication tab, and then click Add Synchronization Link.

Configure the following parameters:

Parameter	Description
Link Name	Enter a name for the custom synchronization link.
Link Description	Enter a description for the custom synchronization link.
Replication Scenario	Select Same Account.
Destination Instance	Select the region and ID of the destination instance.
OSS Replication Role Name	This parameter is not required for same-account scenarios.

Click OK.
After you enable the custom synchronization link, see Synchronize images between instances in the same account to create a sync rule to replicate images from the source instance to the destination instance.

Cross-account sync

Using OSS Cross-Region Replication for cross-account synchronization requires a dedicated RAM role.

Step 1: Configure RAM permissions in the source account

Log on to the source account and go to the Container Registry console.
On the Instances page, click the source instance. Then, on the Overview page, find and record the OSS Bucket name.
Go to the Create RAM Role page to create a RAM role. Set Principal Type to Cloud Service, and set Principal Name to OSS.

On the Create Policy page, click the JSON Editor tab. Replace SRC_BUCKET in the following example with the OSS bucket name you recorded. Then, paste the policy into the policy editor and create the policy.

{
   "Version": "1",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "oss:ReplicateList",
            "oss:ReplicateGet"
         ],
         "Resource": [
            "acs:oss:*:*:{{SRC_BUCKET}}",
            "acs:oss:*:*:{{SRC_BUCKET}}/*"
         ]
      }
   ]
}

After the policy is created, go to the Roles page and click the RAM role you created. On the Basic Information page, find and record the ARN of the role for later use.
On the Permissions tab, click Add Permissions and attach the policy you created in the previous step to the role.

Step 2: Configure RAM permissions in the destination account

Log on to the destination account and go to the Container Registry console.
On the Instances page, click the destination instance. Then, on the Overview page, find and record the OSS Bucket name.
Go to the Bucket List page and click the destination bucket.
In the left-side navigation pane, choose Access Control > Bucket Policy.
Click the Add Graphical Policy tab and then click Receive Replicated Objects.
In the panel that appears, configure the following parameters:
- How to obtain the UID and RAM role: Select Use source RAM role ARN.
- Source RAM role ARN: Enter the ARN of the RAM role you created earlier.
- Authorization purpose: Select Cross-account Cross-region Replication.
Click Generate Policy, and then click Save.

Step 3: Configure the custom sync link

Log on to the source account and go to the Container Registry console.
On the Instances page, click the source instance.
In the left-side navigation pane, choose Distribution > Synchronization Link. Click the OSS Replication tab, and then click Add Synchronization Link.

Configure the following parameters:

Parameter	Description
Link Name	Enter a name for the custom synchronization link.
Link Description	Enter a description for the custom synchronization link.
Replication Scenario	Select Across Accounts.
Destination UID	Enter the UID of the destination account (primary account).
Destination Instance	Select the region and ID of the destination instance.
OSS Replication Role Name	Enter the name of the RAM role you created earlier.

Click OK.
After you enable the custom synchronization link, see Synchronize images between instances in different accounts to create a sync rule to replicate images from the source instance to the destination instance.

Cloud Enterprise Network (CEN)

Step 1: (Optional) Create VPCs

Create a Virtual Private Cloud (VPC) in both the source and destination regions. This example uses a source instance in China (Hangzhou) and a destination instance in Singapore. The VPC in the China (Hangzhou) region is named test1, and the VPC in the Singapore region is named test2.

Step 2: Connect networks with CEN

Create a Cloud Enterprise Network (CEN) instance and configure a transit router in the source and destination regions. For more information, see Connect VPCs across regions.

Step 3: Add VPCs to source and destination instances

Log on to the Container Registry console.
Select the China (Hangzhou) region. On the Instances page, click the target ACR Enterprise Edition instance.
In the left-side navigation pane, choose Repository > Access Control.
On the VPC tab, click Add VPC .
In the Add VPC dialog box, set Existing VPC to test1, select a vSwitch, and then click Confirm.
Switch to the Singapore region. Repeat Steps 3 to 5 for the destination instance to add the VPC named test2. Record the Visit IP of the instance in test2.
You can add a VPC to multiple destination instances in the same region. After the VPC is added, all instances can use this link to synchronize images.
From an ECS instance in the source instance's VPC, test the connectivity to the destination instance by using its IP address. Replace <Target_IP> in the following command with the IP address that you obtained in the previous step, and then run the command:
```
telnet <Target_IP> 443
```
Expected output:
```
Trying <Target_IP>...
Connected to <Target_IP>.
```

Step 4: Configure the custom sync link

You can create only one custom synchronization link between two cross-region instances. Do not create duplicate links.

Log on to the Container Registry console.
In the top navigation bar, select a region.
On the Instances page, click the target ACR Enterprise Edition instance.
In the left-side navigation pane, choose Distribution > Synchronization Link. Click the Cloud Enterprise Network (CEN) tab, and then click Add Synchronization Link.

In the Network Instance wizard, configure the parameters and click Next.

Parameter	Description
Link Name	Enter a name for the custom synchronization link.
Link Description	Enter a description for the custom synchronization link.
Instance ID/Name	Select the ID of the CEN instance.
Source Network	Configure the network in the source instance region: VPC: Select a VPC. In this example, the VPC named test1 in the China (Hangzhou) region is selected. The VPC in the source instance region must be added to the source instance and have cross-region bandwidth configured in CEN. vSwitch: Select a vSwitch. Different regions support vSwitches in different zones. Select a vSwitch in a zone as prompted on the page. Security group: Select a security group to improve the security of the custom synchronization link. Important Ports 80 and 443 must be open in the inbound direction of the security group. Managed security groups are not supported.
Destination Network	Configure the network parameters in the destination instance region: Region: Select the destination instance region. VPC: Select a VPC. In this example, the VPC named test2 in the Singapore region is selected. The VPC in the destination instance region must be added to the destination instance and have cross-region bandwidth configured in CEN.

In the Interconnection Bandwidth wizard, configure the parameters and click Create.

Parameter

Description

Maximum Bandwidth Usage

The maximum bandwidth available for sync tasks on this link. This bandwidth is distributed evenly and dynamically among running sync tasks.

Total Sync Tasks

The maximum number of concurrent sync tasks on this link. Additional tasks are queued.

Standard Edition instances support a maximum of 5 concurrent sync tasks, and Premium Edition instances support a maximum of 10 concurrent sync tasks.

On the Synchronization Link page, find the target link and click Enable in the Actions column.
In the Tips dialog box, click Confirm.
After you enable the custom synchronization link, create a sync rule to replicate images from the source instance to the destination instance. For more information, see Synchronize images between instances in the same account and Synchronize images between instances in different accounts.

FAQ

Check the link type

To check the link type of a sync task, log on to the Container Registry console. On the instance management page, choose Distribution > Replication Record in the left-side navigation pane. On the Replication Record page, the link type for each task is displayed:

Default Link: The default sync link.
Acceleration Link: The sync acceleration link.
Custom Link: A user-configured custom link.

Accelerate image synchronization