DocsICP FilingConsole
Documentation
Home Page Container Registry User Guide Access Configuration Network access control VPC access control Configure VPC access control

Configure VPC access control

Updated at:
Copy as MD
Product
My Favorites

To access an ACR Enterprise Edition instance from within a VPC, configure VPC access control to establish network connectivity between the VPC and the instance.

Prerequisites

Alibaba Cloud DNS PrivateZone is required for VPC domain name resolution. If VPC access is not required, use the public endpoint directly without configuring VPC access control or activating PrivateZone.

How VPC access control works

Connecting a VPC to an Enterprise Edition instance occupies one IP address in the VPC. ACR uses Alibaba Cloud DNS PrivateZone to automatically resolve the instance's VPC domain name to this IP address. No manual configuration is required.

Note

Access control is configured at the VPC level. Select any vSwitch with available IP addresses. After configuration, all resources in the VPC can access the instance through its VPC domain name.

Configuring VPC access control automatically creates a service-linked role named AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone for domain name resolution through Alibaba Cloud DNS PrivateZone. For more information, see Service-linked role for Alibaba Cloud DNS PrivateZone.

Warning

Do not change the DNS zone that is automatically created in Alibaba Cloud DNS PrivateZone. Otherwise, operations such as pulling or deleting images may fail.

Add a VPC

Note

The VPC access control quota must be purchased separately. The initial quota may be 0. If the quota is insufficient or a quota-exceeded error occurs when adding a VPC, see FAQ. For quota and pricing details, see Billing of Enterprise Edition instances.

  1. Log on to the Container Registry console.

  2. In the top navigation bar, select a region.

  3. In the left-side navigation pane, click Instances.

  4. On the Instances page, click the Enterprise Edition instance that you want to manage.

  5. On the instance management page, in the navigation pane on the left, choose Repository > Access Control.

    Note

    To configure access control for a Helm chart, choose Helm Chart > Access Control.

  6. On the VPC tab, click.

  7. In the Add VPC dialog box, select a VPC and a vSwitch, then click Confirm.

    Note

    Only one vSwitch needs to be bound. After binding, all ECS instances in the VPC can access the Enterprise Edition instance.

    The VPC is added when its status changes from Creating to Running.

  8. Optional: View the DNS zone in Alibaba Cloud DNS PrivateZone.

    After the VPC is added, ACR automatically creates a DNS zone in Alibaba Cloud DNS PrivateZone. The DNS zone can be viewed in the PrivateZone console.

    1. Log on to the Alibaba Cloud DNS console.

    2. In the navigation pane on the left, choose Configurations > Private Zone.

      On the User Defined Zones tab, view the DNS zone.

FAQ

Why can't I ping the ACR Enterprise Edition instance or resolve DNS within the same VPC?

The Enterprise Edition instance is not bound to the VPC in the ACR console. Without the binding, Alibaba Cloud DNS PrivateZone does not create the corresponding DNS zone, so resources in the VPC cannot resolve the instance's VPC domain name.

To resolve this issue, follow the steps in the Add a VPC section to bind the target VPC and vSwitch to the Enterprise Edition instance. After the VPC status changes to Running, DNS resolution and access within the VPC work normally.

What do I do if "Image address must be a VPC endpoint" or "Get EOF" errors occur when pushing or pulling images over a VPC?

Depending on the error message, perform one of the following:

  1. Error "Image address must be a VPC endpoint": A VPC endpoint address is used in a non-VPC environment, or a public endpoint address is used in a VPC environment. Check the network environment and use the correct endpoint format:

    • Within a VPC: use an address in the format *-registry-vpc.{region-id}.cr.aliyuncs.com.

    • Over a public network: use an address in the format *-registry.{region-id}.cr.aliyuncs.com.

  2. Error "Get EOF" when pushing images: The client is not in the bound VPC network or the network connection is unavailable. Confirm that the client is running in the VPC bound to the ACR Enterprise Edition instance. If necessary, switch to the public endpoint address.

What do I do if the VPC quota is 0 or a quota-exceeded error occurs when adding a VPC?

The VPC access control quota must be purchased separately. The initial quota may be 0. If VPC access from within a VPC is not needed, no configuration is required and no additional fees are incurred. If images need to be pulled from within a VPC (for example, from ECS instances or ACK clusters), purchase quota before binding the VPC. For quota and pricing details, see Billing of Enterprise Edition instances.

If a quota-exceeded error occurs when adding a VPC, follow these steps to increase the quota:

  1. Log on to the VPC console and check the quota usage.

  2. On the quota management page, click Upgrade to purchase additional VPC quota.

  3. After the purchase is complete, clear the browser cache and wait for the new quota to take effect.

  4. Return to the Enterprise Edition instance, go to the Access Control page, and click Add VPC.

Related documents

To access an Enterprise Edition instance from a different region or from on-premises in a VPC environment, see Access an Enterprise Edition instance across regions or from an on-premises data center.

If issues occur during VPC access control configuration, such as failed VPC-instance connectivity, DNS resolution errors, or PrivateZone error codes, see VPC access control troubleshooting.

Previous：VPC access controlNext：Use a shared VPC to enable cross-account access to a Container Registry Enterprise Edition instance