All Products
Search

This Product

    Container Registry:Build container images with VPC secure build mode

    Document Center

    Container Registry:Build container images with VPC secure build mode

    Last Updated:Apr 24, 2026

    Container Registry provides the VPC secure build mode. This mode lets you host services such as a self-managed GitLab or a Maven repository within a Virtual Private Cloud (VPC) or an on-premises data center connected to a VPC through Express Connect, without exposing a public endpoint. This topic describes how to build container images in this mode.

    Prerequisites

    • Create an Enterprise Edition instance of Container Registry. For more information, see Use an Enterprise Edition instance to push and pull images.

    • Create a self-managed GitLab service in a VPC or an on-premises data center that is located in the same region as your Enterprise Edition instance. If the GitLab service is hosted in a VPC and accessed through an Elastic Compute Service (ECS) IP address, you must add an inbound rule to the security group of the ECS instance to allow traffic from the CIDR block 100.104.0.0/16. If the GitLab service is accessed through a Server Load Balancer (SLB) instance, no security group configuration is required.

    • If your service is in an on-premises data center, its network CIDR block must not conflict with the reverse access CIDR block (100.104.0.0/16). You must also configure return routes for the 100.104.0.0/16 CIDR block on both the virtual border router (VBR) and in the data center. For more information about Express Connect and VBRs, see What is Express Connect? and Virtual border routers (VBRs).

    • Create a VPC and a VSwitch in a zone that supports the secure build mode. The following table lists the supported zones.

      Cloud service

      Region

      Supported zones

      Public cloud

      China (Beijing)

      • cn-beijing-c

      • cn-beijing-d

      • cn-beijing-e

      • cn-beijing-f

      • cn-beijing-i

      • cn-beijing-j

      • cn-beijing-k

      • cn-beijing-g

      • cn-beijing-h

      China (Hangzhou)

      • cn-hangzhou-e

      • cn-hangzhou-f

      • cn-hangzhou-g

      • cn-hangzhou-h

      • cn-hangzhou-i

      • cn-hangzhou-j

      • cn-hangzhou-k

      China (Shenzhen)

      • cn-shenzhen-a

      • cn-shenzhen-b

      • cn-shenzhen-c

      • cn-shenzhen-d

      • cn-shenzhen-e

      • cn-shenzhen-f

      China (Shanghai)

      • cn-shanghai-a

      • cn-shanghai-b

      • cn-shanghai-c

      • cn-shanghai-d

      • cn-shanghai-e

      • cn-shanghai-f

      • cn-shanghai-g

      • cn-shanghai-i

      China (Zhangjiakou)

      • cn-zhangjiakou-a

      • cn-zhangjiakou-b

      • cn-zhangjiakou-c

      China (Hong Kong)

      • cn-hongkong-b

      • cn-hongkong-c

      • cn-hongkong-d

      Singapore

      • ap-southeast-1a

      • ap-southeast-1b

      • ap-southeast-1c

      Indonesia (Jakarta)

      • ap-southeast-5a

      • ap-southeast-5b

      US (Virginia)

      • us-east-1a

      • us-east-1b

      US (Silicon Valley)

      • us-west-1a

      • us-west-1b

      UK (London)

      • eu-west-1a

      • eu-west-1b

      Germany (Frankfurt)

      • eu-central-1a

      • eu-central-1b

      Japan (Tokyo)

      • ap-northeast-1a

      • ap-northeast-1b

      China (Chengdu)

      • cn-chengdu-a

      • cn-chengdu-b

      China (Heyuan)

      • cn-heyuan-a

      • cn-heyuan-b

      Alibaba Finance Cloud

      China (Hangzhou)

      • cn-hangzhou-finance-i

      • cn-hangzhou-finance-j

      • cn-hangzhou-finance-k

      • cn-hangzhou-finance-h

    Managed security groups

    When you bind a source code repository in your VPC, Container Registry calls an ECS API operation to create a managed security group. This allows the Container Registry build service to access your self-managed GitLab service within the VPC. For more information, see Managed security groups.

    Note

    • This is a system-managed, read-only security group. You cannot modify it. The security group denies all inbound traffic and allows outbound traffic only to specified endpoints, such as the private endpoints of your GitLab and Maven repositories.

    • The Container Registry build instance accesses your self-managed GitLab service by using this managed security group and an elastic network interface (ENI) attached to your specified VSwitch.

    Step 1: Manage the link

    1. Log on to the Container Registry console.

    2. In the top navigation bar, select a region.

    3. In the left-side navigation pane, select Instances.

    4. On the Instances page, click the target Enterprise Edition instance.

    5. On the Overview page, select Repository > Code Source.

    6. On the Code Source page, find GitLab and click Manage Link in the Actions column.

    7. In the Manage Link dialog box, configure the parameters for the VPC access link and click Create.

      Table 1. Parameters for creating a VPC access link

      Parameter

      Description

      GitLab Private IP Address

      The private endpoint of your self-managed GitLab source code repository.

      Other IP addresses that need to be allowed

      Enter any other private endpoints to whitelist.

      Existing VPC

      Select the VPC that you prepared in the Prerequisites section.

      Vswitch

      Select the VSwitch that you prepared in the Prerequisites section.

    Step 2: Bind GitLab

    1. On the Code Source page, find GitLab and click Bind Account in the Actions column.

    2. In the Private GitLab dialog box, configure the parameters to bind your GitLab source code repository and click Confirm.

      Table 2. Parameters for binding a VPC-based source code repository

      Parameter

      Description

      Network Type

      Select VPC.

      Link Information

      Select the link that you created in Step 1: Manage the link.

      Endpoint

      Enter the logon endpoint of your GitLab instance within the VPC.

      • If you use a private GitLab, enter its login endpoint.

      • If you use a public GitLab, enter its login endpoint.

      Username

      The username for your GitLab account.

      Private Token

      Your personal access token. For information about how to create a token, see Bind a source code hosting platform.

      If the GitLab status bar displays Bound, the VPC source code repository is bound successfully.

    Step 3: Build an image

    Warning

    When you use the VPC secure build mode, you must disable the build with servers deployed outside the Chinese mainland option.

    After you bind the source code repository, you can build images. For more information, see Build images by using an Enterprise Edition instance.