Elastic Container Instance (ECI) pulls images over HTTPS by default. If your self-managed image repository uses plain HTTP or a self-signed TLS certificate, image pulls fail with an ErrImagePull event. Use the PlainHttpRegistry or InsecureRegistry parameter when creating an ECI instance or image cache to resolve either type of failure.
Prerequisites
Before you begin, make sure that:
Network connectivity between ECI and the image repository is established
You are creating the elastic container instance or image cache by calling an API operation (
CreateContainerGrouporCreateImageCache); the console does not support the required parameters
HTTP repositories
If your repository serves images over plain HTTP, ECI rejects the connection because it expects HTTPS by default. Set the PlainHttpRegistry parameter to the repository address when calling CreateContainerGroup or CreateImageCache. ECI then uses HTTP to pull the image instead of HTTPS.
| Attribute | Value |
|---|---|
| Parameter | PlainHttpRegistry |
| Type | String |
| Example value | harbor***.pre.com,192.168.XX.XX:5000,reg***.test.com:80 |
Self-signed certificate repositories
If your repository uses HTTPS with a self-signed certificate, ECI fails certificate chain verification and rejects the connection. Set the InsecureRegistry parameter to the repository address when calling CreateContainerGroup or CreateImageCache. ECI then skips certificate verification for that repository.
| Attribute | Value |
|---|---|
| Parameter | InsecureRegistry |
| Type | String |
| Example value | harbor***.pre.com,192.168.XX.XX:5000,reg***.test.com:80 |
Parameter format
Both PlainHttpRegistry and InsecureRegistry accept a comma-separated list of repository addresses.
| Rule | Details |
|---|---|
| Multiple repositories | Separate addresses with commas. Example: harbor***.pre.com,192.168.XX.XX |
| Address with port | Include the port number. For a repository at 192.168.XX.XX:5000/nginx:latest, set the parameter to 192.168.XX.XX:5000 |