Container Registry:What is Container Registry?

Container Registry Enterprise Edition

Container Registry Enterprise Edition is a dedicated, enterprise-grade registry for production workloads. Each instance is isolated at the resource level, with no shared infrastructure, giving you predictable performance and strong security boundaries.

Key characteristics:

• Dedicated instance with no shared resources
• 99.95% SLA with cross-zone high availability included by default in multi-zone regions
• Supports container images, Helm Charts (v2/v3), and any OCI-compliant artifact
• Configurable network access controls (VPC isolation, allowlists)
• Full audit trail via ActionTrail
• Available in Basic Edition and Advanced Edition tiers (see Specifications for a full feature comparison)

Recommended for: Teams running production services on ACK or any Kubernetes-based environment.

Container Registry Personal Edition (for individuals)

Container Registry Personal Edition provides basic image hosting, image building, and image authorization services for individual developers and exploratory use.

Recommended for: Individual developers learning container workflows or experimenting with ACR features.

Artifact hosting

ACR stores multi-architecture container images (Linux, Windows, Arm), Helm Charts (v2/v3), and any artifact conforming to the Open Container Initiative (OCI) specification. You can enforce version immutability on tags to prevent accidental overwrites and use automated tag cleanup rules to control storage consumption.

Accelerated distribution

Container Registry Enterprise Edition supports global synchronization to replicate images across multiple Alibaba Cloud regions. The Advanced Edition adds P2P (peer-to-peer) distribution acceleration and on-demand distribution (lazy pulling), which significantly reduce the time to start container workloads at scale across large node pools.

Pull throughput guarantees by tier:

Security and compliance

• Vulnerability scanning: Multi-engine scanning generates multi-dimensional vulnerability reports on stored images, helping you catch known CVEs before deployment.
• Vulnerability fixing: Enterprise Edition identifies fixable vulnerabilities and guides remediation.
• Threat blocking: Advanced Edition only. Policy-based automatic blocking prevents images that fail your security policy from being pulled.
• Image signing: Advanced Edition only. Cosign-compatible signing and signature verification protect your software supply chain.
• Network access control: Restrict instance access to specific VPCs and CIDR ranges.
• Audit logging: All image push, pull, and management events are logged to ActionTrail for compliance reporting.
• Credential-free pull: Supported on Container Registry Enterprise Edition instances. Note: instances created on or after September 4, 2024 support credential-free pull on Enterprise Edition only; Container Registry Personal Edition instances created on or after that date do not support this feature.

Build and CI/CD integration

ACR provides a managed image build service that can compile source code from connected repositories and produce container images directly, with up to 10 concurrent build jobs on the Advanced Edition. Built images proceed directly into your scan-and-sign workflow before reaching your ACK clusters.

Artifact subscription and event notifications

You can subscribe to upstream public repositories and receive updates automatically when new versions are published. Event notifications integrate with downstream automation, triggering deployment pipelines or alert systems when images are pushed or scan results are available.

Multi-region disaster recovery

Container Registry Enterprise Edition instances in multi-zone Alibaba Cloud regions include cross-zone high availability by default. For cross-region disaster recovery, deploy separate instances in each target region. Storage-level redundancy is available using OSS zone-redundant storage (ZRS) for cross-zone data protection and OSS cross-region replication (CRR) for cross-region data backup.

CI/CD pipeline integration

Connect ACR to your source repositories to automatically build images on every commit. Vulnerability scanning runs immediately after build, and you can configure threat blocking rules to prevent non-compliant images from reaching your ACK clusters. This gives you a repeatable, auditable path from source code to production.

Multi-region and global deployments

Use global synchronization rules to automatically replicate images from a primary region to one or more secondary regions. Combined with P2P distribution (Advanced Edition), you can dramatically reduce image pull times for services running across geographically distributed Kubernetes clusters.

Enterprise security and compliance

Apply network access controls to restrict registry access to specific VPCs. Enforce tag immutability to maintain a reliable audit trail. Sign images with Cosign and verify signatures at deployment time. Export ActionTrail logs to your SIEM for centralized compliance reporting.

Migration from self-managed registries

Use the fast image import feature to migrate images from Harbor to Container Registry Enterprise Edition without re-pushing through a local client. Artifact subscription can replace manual sync scripts for external public images you depend on.

Quotas

Distribution and security

Disaster recovery