Use the image import feature to migrate images from a Personal Edition instance to an Enterprise Edition instance with a single click. The import does not affect the normal use of either instance.
After migration, your workloads gain access to enterprise-grade artifact management, security scanning, and accelerated image pulling.
Prerequisites
Before you begin, ensure that you have:
A Personal Edition instance with the namespaces and repositories you want to migrate
An Enterprise Edition instance in the target region
(Conditional) A Virtual Private Cloud (VPC) bound to the Enterprise Edition instance, with a security group that allows inbound and outbound traffic on TCP port 443. Skip this if you use Alibaba Finance Cloud or Alibaba Gov Cloud.
(Optional) A source code hosting platform bound to the Enterprise Edition instance, if you need to migrate image build configurations. See Bind a source code hosting platform.
What is imported
The import copies the following data from the Personal Edition instance:
Namespace names, automatic repository creation settings, and default repository types
Repository names and repository types
A specified number of the most recently pushed images from each repository (0–1,000 per repository)
Image build configurations, including bound source code information and build rules
What is not imported: Build history is not migrated.
Step 1: Bind a VPC
Skip this step if a VPC is already bound to your Enterprise Edition instance with a security group that allows inbound and outbound traffic on TCP port 443, or if you use Alibaba Finance Cloud or Alibaba Gov Cloud.
In the public cloud, the system automatically creates a service-linked role named AliyunServiceRoleForContainerRegistryConnectCustomerVPC. Container Registry uses this role to import images over your VPC network to maximize import speed. For more information, see Service-linked roles for VPC access.
Create a VPC, a vSwitch, and a security group in the region where your Enterprise Edition instance is located. The security group must have an inbound rule that allows traffic on TCP port 443 from the CIDR block of the VPC. See Create a VPC, Create a vSwitch, and Create a security group.
Log on to the Container Registry console.
In the top navigation bar, select the target region.
In the left-side navigation pane, click Instances.
On the Instances page, click the Enterprise Edition instance.
In the left-side navigation pane, choose Repository Management > Access Control.
On the VPC tab, click Add VPC.
In the Add VPC dialog box, select a VPC and a vSwitch, then click OK.
The VPC is added. Wait until its status changes from Creating to Running before proceeding.
The VPC and vSwitch must be in a supported zone. The following table lists supported zones by region.
| Region | Supported zones |
|---|---|
| China (Beijing) | cn-beijing-c, cn-beijing-d, cn-beijing-e, cn-beijing-f, cn-beijing-g, cn-beijing-h, cn-beijing-i, cn-beijing-j, cn-beijing-k |
| China (Hangzhou) | cn-hangzhou-e, cn-hangzhou-f, cn-hangzhou-g, cn-hangzhou-h, cn-hangzhou-i, cn-hangzhou-j, cn-hangzhou-k |
| China (Shenzhen) | cn-shenzhen-b, cn-shenzhen-c, cn-shenzhen-d, cn-shenzhen-e, cn-shenzhen-f |
| China (Shanghai) | cn-shanghai-a, cn-shanghai-b, cn-shanghai-d, cn-shanghai-e, cn-shanghai-f, cn-shanghai-g, cn-shanghai-i |
| China (Zhangjiakou) | cn-zhangjiakou-a, cn-zhangjiakou-b, cn-zhangjiakou-c |
| China (Hong Kong) | cn-hongkong-b, cn-hongkong-c, cn-hongkong-d |
| Singapore | ap-southeast-1a, ap-southeast-1b, ap-southeast-1c |
| Indonesia (Jakarta) | ap-southeast-5a, ap-southeast-5b |
| US (Virginia) | us-east-1a, us-east-1b |
| US (Silicon Valley) | us-west-1a, us-west-1b |
| UK (London) | eu-west-1a, eu-west-1b |
| Germany (Frankfurt) | eu-central-1a, eu-central-1b |
| Japan (Tokyo) | ap-northeast-1a, ap-northeast-1b |
| China (Chengdu) | cn-chengdu-a, cn-chengdu-b |
| China (Heyuan) | cn-heyuan-a, cn-heyuan-b |
Step 2 (optional): Bind a source code platform
Skip this step if you do not need to migrate image build configurations.
In the Enterprise Edition instance, bind the same source code hosting platform used by the Personal Edition instance. See Bind a source code hosting platform.
Step 3: Create an import rule and run the import
Log on to the Container Registry console.
In the top navigation bar, select the target region.
In the left-side navigation pane, click Instances.
On the Instances page, click the Enterprise Edition instance.
In the left-side navigation pane, choose Instance Management > Image Import.
On the Image Import page, configure the import rule parameters.
Parameter Description VPC Displays Bound if a VPC is configured, or Unbound if not. A bound VPC accelerates the import. Source The image source. You can import images from a Personal Edition instance or an OSS bucket. For this topic, select Personal Edition instance. Region The region of the source Personal Edition instance. Namespace The namespace in the Personal Edition instance to import from. Image selection Controls which images to import: (1) Specify the number of most recently pushed images to import per repository (0–1,000; 0 means no images are imported). (2) Optionally, enter a regular expression to filter images by tag. For example, release-v.*imports only images whose tags start withrelease-v. By default, all images are selected.Overwrite image When selected, overwrites an existing image in the Enterprise Edition instance if it has the same tag but a different digest. Selected by default. Click OK to save the rule.
In the Import Rules section, click Trigger Import.
In the Tips dialog box, click OK to start the import.
When the Result column shows Success, the import is complete.
If the Result column shows Verification failed, the import failed. Hover over Verification failed to see the reason.
Switch workloads to the Enterprise Edition instance
After importing, update your workloads to use the Enterprise Edition instance's domain name. Choose the approach that fits your situation:
| Approach | When to use |
|---|---|
| Update image addresses and credentials directly | You can modify your workload configurations (Kubernetes manifests, CI/CD pipelines, etc.) |
| Enable domain name compatibility | You want to minimize changes — this lets existing workloads access the Enterprise Edition instance using the Personal Edition domain name, without reconfiguring image addresses or credentials |
To enable domain name compatibility, see Access an Enterprise Edition instance by using the domain name of a Personal Edition instance.
More operations
View import details
On the Image Import page, find the import task and click Details in the Actions column. The details page shows the total data size (GB), current transfer speed (MBps), total number of images, and the number of successful and failed imports per repository, including failure reasons.
Update an import rule
On the Image Import page, click Update Rule in the Import Rules section. Modify the rule in the Update Import Rule dialog box and click OK. Then click Import Again and confirm in the Tips dialog box.
What's next
Pull images directly from the Enterprise Edition instance using the credentials-free component. See Pull container images by using the credentials-free component of Container Service for Kubernetes (ACK).