Create an ACS workload by using a self-managed image repository-Container Compute Service(ACS)-阿里云帮助中心

When you pull an image from a self-managed image repository, you might encounter image pull failures. Common causes include protocol mismatches, certificate authentication errors, or the use of a custom DNS server. This topic describes how to pull images from a self-managed image repository to create an ACS workload when the repository uses the HTTP protocol, a self-signed certificate, or a custom DNS server.

Background

When you pull an image from a self-managed image repository, an ErrImagePull event may occur, indicating that the image pull has failed. Assuming your ACS cluster can connect to the image repository over the network, the following table lists the common causes and solutions.

Scenario	Cause	Solution
The self-managed image repository uses the HTTP protocol.	ACS pulls images over HTTPS by default. A protocol mismatch causes the image pull to fail.	Configure ACS to use the HTTP protocol to communicate with the image repository.
The self-managed image repository uses the HTTPS protocol but with a self-signed certificate.	The image pull fails because ACS cannot authenticate the self-signed certificate.	Configure ACS to skip certificate authentication.
The domain of the self-managed image repository uses a custom DNS server.	By default, ACS uses Alibaba Cloud DNS (100.100.2.136 and 100.100.2.138) to resolve the image repository's domain. If the domain record for the image repository exists only on your custom DNS server, the image pull fails.	See Configure custom DNS by using an annotation.

Configuration

If you need to pull an image from a self-managed image repository that uses the HTTP protocol or a self-signed certificate, you must configure the following annotations on the Pod to prevent image pull failures.

Parameter	Type	Value	Description
`registry.alibabacloud.com/plain-http-registry`	String	`"harbor*.pre.com,192.168.XX.XX:5000,reg*.test.com:80"`	Allows ACS to pull images over HTTP from specified repositories. This prevents failures caused by a protocol mismatch.
`registry.alibabacloud.com/insecure-registry`	String	`"harbor*.pre.com,192.168.XX.XX:5000,reg*.test.com:80"`	Allows ACS to skip certificate authentication for repositories that use a self-signed certificate. This prevents pull failures caused by authentication errors.

Note

If you need to pull images for multiple containers from different image repositories, you can specify multiple repository addresses. Separate the addresses with a comma (,), for example, harbor***.pre.com,192.168.XX.XX.

The following steps provide an example for a stateless application:

Log on to the ACS console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left navigation pane, choose Workloads > Deployments.
On the Deployments page, click Create with Image.
On the Basic Information page, enter the required information and click Next.
On the Container page, configure the container and click Next.
On the Advanced page, in the Pod Annotations section, add the required annotations. For example, add registry.alibabacloud.com/plain-http-registry and registry.alibabacloud.com/insecure-registry and then click Create.