By default, an ECI instance is assigned only a private IP address. If your ECI instance needs to connect to the internet, for example, to pull public images, you can associate an EIP with the instance or create an internet NAT gateway in its VPC to enable internet access.
Background information
You can use one of the following methods to configure internet access for an ECI instance:
|
Method |
Description |
Use cases |
|
Associate an EIP |
An elastic IP address (EIP) is a public IP address that you can purchase and hold independently. It provides internet access for the associated ECI instance. For more information, see What is an elastic IP address and EIP billing overview. |
A single ECI instance. For example, if you have an ECI instance that runs an Nginx service, you can associate an EIP with the instance during creation. When Nginx starts, it automatically exposes port 80 to the EIP. You can then access the Nginx service using the EIP and port number. |
|
Create an internet NAT gateway in the VPC |
A NAT gateway is a network address translation (NAT) service that provides SNAT and DNAT capabilities. For more information, see What is a NAT gateway and NAT gateway billing. |
Multiple ECI instances. For example, you have multiple ECI instances that need to pull images from Docker Hub. Because ECI does not provide an internet connection by default for pulling public images, you must create an internet NAT gateway in the instances' VPC and configure its rules. Otherwise, the instances cannot pull the images. |
When you configure internet access for an ECI instance, make sure that the security group of the ECI instance allows traffic on the required IP addresses and ports. For more information, see Add a security group rule.
Associate an EIP with an ECI instance
When you create an ECI instance, you can associate an existing EIP with the instance or automatically create and associate a new one.
An EIP provides internet access to a single ECI instance. If multiple ECI instances need internet access, you must associate a separate EIP with each instance or create an internet NAT gateway.
API
When you call the CreateContainerGroup operation to create an ECI instance, you can use the EipInstanceId parameter to associate an existing EIP, or use the AutoCreateEip and EipBandwidth parameters to automatically create and associate an EIP. The following tables describe these parameters. For more information, see CreateContainerGroup.
-
Associate an existing EIP
Parameter
Type
Example
Description
EipInstanceId
String
eip-uf66jeqopgqa9hdn****
The ID of the EIP to associate with the ECI instance.
-
Automatically create and associate an EIP
Parameter
Type
Example
Description
AutoCreateEip
Boolean
true
Specifies whether to automatically create an EIP and associate it with the ECI instance. A value of
trueenables this feature.EipBandwidth
Integer
5
The bandwidth of the EIP. Unit: Mbps. The default value is 5.
EipISP
String
BGP
The line type of the EIP. This parameter is available only for pay-as-you-go EIPs. Valid values:
-
BGP(default): BGP (Multi-ISP) -
BGP_PRO: BGP (Multi-ISP) Pro
For more information, see EIP line types.
EipCommonBandwidthPackage
String
cbwp-2zeukbj916scmj51m****
The ID of an existing Internet Shared Bandwidth instance to which you want to add the EIP. For more information, see What is Internet Shared Bandwidth.
-
Console
When you create an ECI instance in the console, after you complete the basic settings, go to the Other Settings section. You can then associate an EIP with the ECI instance. You can use an existing EIP or automatically create a new one.
Create an internet NAT gateway
An Internet NAT gateway provides internet access for ECI instances in its VPC by offering SNAT and DNAT capabilities.
|
Feature |
Description |
|
SNAT |
Enables ECI instances without a public IP address in a VPC to access the internet. |
|
DNAT |
Maps an EIP that is associated with the internet NAT gateway to an ECI instance in the VPC, enabling the instance to provide services over the internet. |
-
Create an Internet NAT gateway in the VPC console. For more information, see Internet NAT gateway.
-
To allow your ECI instances to access the internet, create an SNAT entry. For more information, see Create and manage SNAT entries.
The following table describes the key parameters.
Parameter
Description
SNAT entry granularity
Select an option based on your network topology and security requirements:
-
Specify VPC: All ECI instances in the NAT gateway's VPC can use the SNAT feature to access the internet.
-
Specify vSwitch: All ECI instances in the selected vSwitches can use the SNAT feature to access the internet.
-
Specify Custom CIDR Block: All ECI instances in the specified CIDR block can use the SNAT feature to access the internet.
Select vSwitch
This parameter is available when you set Specify vSwitch to Specify vSwitch. Select the vSwitches where the ECI instances are created. You can select multiple vSwitches.
Custom CIDR block
This parameter is available when you set Specify Custom CIDR Block to Specify Custom CIDR Block. Specify the CIDR block of the ECI instances that require internet access.
Select public IP address
Select one or more EIPs that are associated with the NAT gateway to access the internet.
NoteIf an ECI instance already has an associated EIP, the instance uses that EIP for internet access instead of the SNAT feature of the NAT gateway.
-
-
To allow your ECI instances to provide services over the internet, create a DNAT entry. For more information, see Create and manage DNAT entries.
The following table describes the key parameters.
Parameter
Description
Select public IP address
Select an EIP associated with the NAT gateway to expose an ECI instance to the internet.
Select private IP address
Select the ECI instances that you want to expose to the internet through the DNAT rule. You can specify the elastic network interface of an ECI instance or enter the private IP address of an ECI instance.
Port settings
Select a DNAT mapping method:
-
Any port: This method provides IP mapping. All requests that are sent to the EIP associated with the NAT gateway are forwarded to the target ECI instance.
-
Specific port: This method provides port mapping. The NAT gateway forwards requests of a specific protocol from a specific port on the EIP to a specific port on the target ECI instance.
-