What Is a Container Image Deployment Package - Compute Nest

Use cases

For private deployments that pull Docker container images from the public internet, you can use a container image deployment package with a temporary key.

Important

Container image deployment packages do not support auto scaling or frequent image pulls after the initial deployment.

When not to use container image deployment packages

Services without public network access

For services that cannot access the public internet, you can create a self-managed Container Registry (ACR) repository. Configure the repository's internal endpoint to pull images over the internal network. For more information, see Configure VPC access control.
Services that require image pulls after deployment

Private deployment: You must provide a self-managed, public Container Registry (ACR) repository to maintain pull access.

Fully managed service: You can create a private Container Registry (ACR) repository and use the aliyun-acr-credential-helper component provided by a Container Service for Kubernetes (ACK) cluster to pull images.

For more information, see Use the aliyun-acr-credential-helper component to pull images without using a secret.
Publicly accessible container images

If your container images are publicly accessible, you do not need to use a container image deployment package. You can deploy them directly using the public container image repository URL.

How it works

To ensure multi-tenancy, container images from different service providers are stored in a shared repository but isolated by namespace. Each service provider is mapped to a unique namespace. When uploading or pulling an image, a temporary key is generated for the namespace based on the service provider's AliUid. Access control is enforced at the namespace level.

Details

Upload a container image to the Compute Nest ACR repository
1. The service provider requests a temporary key from Compute Nest. Compute Nest then obtains a key from Container Registry (ACR) for the namespace that corresponds to the service provider's AliUid.
2. The service provider uses this temporary key to upload the local container image to the Compute Nest ACR repository. The image is stored in the namespace associated with the service provider's AliUid.
Deploy a container image to an ACK cluster
1. Compute Nest obtains the temporary key for the service provider's container image and deploys it as a Secret to the ACK cluster.
2. During deployment, Compute Nest replaces the container image deployment package placeholder with the URL of the image in the Compute Nest container image repository and specifies the deployed Secret as the pull credential.
3. The ACK cluster then uses the Secret to pull the container image and complete the deployment.

Why use a managed solution for container image deployment packages?

Docker container images can be stored in Container Registry (ACR). Although service providers can upload images to their own private repositories, Compute Nest offers a public Compute Nest ACR repository. This managed solution reduces the cost of purchasing ACR instances, simplifies security scanning, and prevents accidental image deletion, ensuring both security and stability.

Implementation

You must define the following two placeholders in your service's Resource Orchestration Service (ROS) template. These placeholders are replaced with actual values during deployment.

{{ computenest::acrimage::yourimage }}: A placeholder for the container image deployment package. During deployment, Compute Nest replaces this with the URL of the associated container image, such as compute-nest-registry.cn-hangzhou.cr.aliyuncs.com/aliUid1/volcanosh/vc-controller-manager:1.0.
{{ computenest::acr::dockerconfigjson }}: A placeholder for the image pull credential. During deployment, this is replaced with a temporary key used to pull the private container image.

The following YAML example shows how to use a container image deployment package. The pull credential placeholder {{ computenest::acr::dockerconfigjson }} is deployed as a Secret named computenestrepo. This Secret is then used as the imagePullSecret to pull the container image after the image placeholder is replaced.

Example code

Resources:
  ClusterApplication:
    Type: ALIYUN::CS::ClusterApplication
    Properties:
      YamlContent: |
          apiVersion: v1
          data:
            .dockerconfigjson: {{computenest::acr::dockerconfigjson}}
          kind: Secret
          metadata:
            name: computenestrepo
            namespace: nginx
          type: kubernetes.io/dockerconfigjson
          ---
          apiVersion: apps/v1
          kind: Deployment
          spec:
            template:
              spec:
                containers:
                - name: nginx
                  image: {{ computenest::acrimage::nginx }}
                  ports:
                  - containerPort: 80
                imagePullSecrets:
                - name: computenestrepo

Create and use

Prerequisites

You must have Docker installed and a Docker image created. If not, see Install and use Docker.

Create a deployment package

Configure basic information for the deployment package.

Log on to the Compute Nest console. In the left-side navigation pane, choose Service Deployment Package. On the Packages tab, click Create Deployment Package.

In the Basic Information section, configure the following parameters.

Parameter	Description
Deployment Package Name	The name can contain Chinese characters, English letters, digits, and underscores (_). The name must be 3 to 128 characters long, where a Chinese character counts as two characters. The deployment package name cannot be changed after creation.
Version Name	The name can contain Chinese characters, English letters, digits, and underscores (_). The name must be 3 to 50 characters long, where a Chinese character counts as two characters.
Description	The description must be 10 to 500 characters long. A Chinese character counts as two characters.
Resource Group	Select the resource group to which the deployment package belongs. Resource groups allow you to group your cloud resources by usage, permissions, or ownership, enabling hierarchical resource management for multiple users and projects within an organization. For more information, see resource groups.
Tag Settings	Select or enter a complete tag key and tag value to add a tag to the deployment package. You can bind up to 20 tags to a resource. If no tag keys or values are available, you can create a custom tag. For more information, see Create and bind a custom tag.

Configure the container image deployment package.

This section uses uploading an apache-php5 image as an example.

In the Deployment Package Content section, set Deployment Package Type to Container Image.

Click Obtain Access Credential to get the commands for uploading your container image to the Compute Nest repository.

After you obtain the credential, the page displays the required commands. First, log on to the Compute Nest image repository with the docker login command. Next, after entering the Image Name and Tag (for example, latest), tag your local image by using the docker tag command. Finally, push the tagged image to the repository with the docker push command.

Log on to your command-line tool and run the login command to access the Compute Nest image repository.

docker login compute-nest-registry.cn-hangzhou.cr.aliyuncs.com --username=cr_temp_user --password=<temporary_token>

Tag your container image for the Compute Nest image repository.

docker tag registry.cn-hangzhou.aliyuncs.com/lxepoo/apache-php5:latest compute-nest-registry.cn-hangzhou.cr.aliyuncs.com/lxepoo/apache-php5:latest

Push the tagged container image.

docker push compute-nest-registry.cn-hangzhou.cr.aliyuncs.com/156345785543852/registry.cn-hangzhou.aliyuncs.com/lxepoo/apache-php5:latest
The push refers to repository [compute-nest-registry.cn-hangzhou.cr.aliyuncs.com/156345785543852/registry.cn-hangzhou.aliyuncs.com/lxepoo/apache-php5]
6bb81559e239: Pushed
cea911103474: Pushed
cc523d99ead5: Pushed
b00b1ec7b8ef: Pushed
7715ecdbe18e: Pushed
5e755f0e0b5c: Pushed
2a1ce34e52b6: Pushed
28dc854edc91: Pushed
24fc817b31ed: Pushed
7cd75a52f72c: Pushed
05b156d2bc54: Pushed
8cc36998586f: Pushed
ab73fa68e475: Pushed
dbf739521f53: Pushed
3e019add9ad9: Pushed
18e3751aa1ef: Pushed
4eb95f543324: Pushed
a594229cce80: Pushed
69a54e38f06b: Pushed
d2808f8124fd: Pushed
fe4c16cbf7a4: Pushed
latest: digest: sha256:2afcd2b89f317e0570325817f4e8d9c93f12ac781779e365e456ae37aa297f7a size: 4700

After the push is successful, in the Container Image section, choose the image you uploaded and click Publish Deployment Package.

View the deployment package.
1. Return to the Service Deployment Package page. Click the name of the deployment package to go to the Deployment Package Details page and view its status.
2. When the status changes to Available, the package is created.

Use the deployment package

This section explains how to use a container image deployment package when creating a private deployment service.

Log on to the Compute Nest console.
In the left-side navigation pane, click My Services. On the Created Services tab of the My Services page, click Create Service.
On the Create New Service page, select Custom launch as the creation method, select Private Service as the service type, and click Next: Configure Settings.

Enter the basic service information and enter the ROS template as required.

In the ROS template, define the {{ computenest::acr::dockerconfigjson }} placeholder for the access credential and the {{ computenest::acrimage::yourimage }} placeholder for the container image within the ALIYUN::CS::ClusterApplication resource.

Example template

Note

This sample template is for testing only.

ROSTemplateFormatVersion: '2015-09-01'
Description:
  en: Application deployed by using Docker.
  zh-cn:  使用docker部署单机应用
Parameters:
  PayType:
    Type: String
    Label:
      en: ECS Instance Charge Type
      zh-cn: 付费类型
    Default: PostPaid
    AllowedValues:
      - PostPaid
      - PrePaid
    AssociationProperty: ChargeType
    AssociationPropertyMetadata:
      LocaleKey: InstanceChargeType
  PayPeriodUnit:
    Type: String
    Label:
      en: Pay Period Unit
      zh-cn: 购买资源时长周期
    Default: Month
    AllowedValues:
      - Month
      - Year
    AssociationProperty: PayPeriodUnit
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${PayType}
              - PostPaid
  PayPeriod:
    Type: Number
    Label:
      en: Period
      zh-cn: 购买资源时长
    Default: 1
    AllowedValues:
      - 1
      - 2
      - 3
      - 4
      - 5
      - 6
      - 7
      - 8
      - 9
    AssociationProperty: PayPeriod
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${PayType}
              - PostPaid
  EcsInstanceType:
    Type: String
    Label:
      en: Instance Type
      zh-cn: 实例类型
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      InstanceChargeType: ${PayType}
    AllowedValues:
      - ecs.g8i.large
      - ecs.g6.large
  InstancePassword:
    NoEcho: true
    Type: String
    Description:
      en: The password of the server. The password must be 8 to 30 characters in length and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
      zh-cn: 服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    AllowedPattern: '^[a-zA-Z0-9-\(\)\`\~\!\@\#\$\%\^\&\*\_\-\+\=\|\{\}\[\]\:\;\<\>\,\.\?\/]*$'
    Label:
      en: Instance Password
      zh-cn: 实例密码
    ConstraintDescription:
      en: The password must be 8 to 30 characters in length and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/.
      zh-cn: 长度 8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    MinLength: 8
    MaxLength: 30
    AssociationProperty: ALIYUN::ECS::Instance::Password
  ZoneId:
    Type: String
    Label:
      en: Zone ID
      zh-cn: 可用区ID
    AssociationProperty: ALIYUN::ECS::Instance::ZoneId
  VpcId:
    Type: String
    Label:
      en: VPC ID
      zh-cn: 专有网络VPC实例ID
    Description:
      en: The ID of the existing VPC.
      zh-cn: 现有虚拟专有网络的实例ID
    AssociationProperty: 'ALIYUN::ECS::VPC::VPCId'
  VSwitchId:
    Type: String
    Label:
      en: VSwitch ID
      zh-cn: 交换机实例ID
    Description:
      en: The ID of the existing VSwitch.
      zh-cn: 现有业务网络交换机的实例ID
    Default: ''
    AssociationProperty: 'ALIYUN::ECS::VSwitch::VSwitchId'
    AssociationPropertyMetadata:
      VpcId: VpcId
      ZoneId: ZoneId
  AdminPassword:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::Password
    Label: Administrator Password
    NoEcho: True
Resources:
  SecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      SecurityGroupName:
        Ref: ALIYUN::StackName
      VpcId:
        Ref: VpcId
      SecurityGroupIngress:
        - PortRange: 80/80
          Priority: 1
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
          NicType: internet
  InstanceGroup:
    Type: ALIYUN::ECS::InstanceGroup
    Properties:
      # Billing method
      InstanceChargeType:
        Ref: PayType
      PeriodUnit:
        Ref: PayPeriodUnit
      Period:
        Ref: PayPeriod
      VpcId:
        Ref: VpcId
      VSwitchId:
        Ref: VSwitchId
      SecurityGroupId:
        Ref: SecurityGroup
      ZoneId:
        Ref: ZoneId
      ImageId: centos_7
      Password:
        Ref: InstancePassword
      InstanceType:
        Ref: EcsInstanceType
      SystemDiskCategory: cloud_essd
      SystemDiskSize: 200
      InternetMaxBandwidthOut: 5
      IoOptimized: optimized
      MaxAmount: 1
  WaitCondition:
    Type: ALIYUN::ROS::WaitCondition
    Properties:
      Count: 1
      Handle:
        Ref: WaitConditionHandle
      Timeout: 300
  WaitConditionHandle:
    Type: ALIYUN::ROS::WaitConditionHandle
  InstallPackage:
    Type: ALIYUN::ECS::RunCommand
    Properties:
      InstanceIds:
        Fn::GetAtt:
          - InstanceGroup
          - InstanceIds
      Type: RunShellScript
      Sync: true
      Timeout: 300
      CommandContent:
        Fn::Sub:
          - |
            yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
            yum makecache fast
            yum -y install docker-ce jq
            systemctl enable docker
            systemctl start docker
            sleep 10
            dockerJson='{{ computenest::acr::dockerconfigjson }}'
            decodeDockerJson=$(echo $dockerJson | base64 -d)
            host=$(echo $decodeDockerJson | jq '.auths' | jq 'keys' | jq .[0])
            username=$(echo $decodeDockerJson | jq ".auths.$host.username" | tr -d '"')
            password=$(echo $decodeDockerJson | jq ".auths.$host.password" | tr -d '"')
            host=$(echo $host | tr -d '"')
            docker login $host --username=$username --password=$password
            mkdir -p /home/admin/application
            cat >/home/admin/application/docker-compose.yaml<<EOF
            # You can reference parameters in the docker-compose.yaml file.
            # A single nginx service instance.
            services:
              # Service name
              nginx:
                # Docker image
                image: {{computenest::acrimage::nginx}}
                # Port mapping
                ports:
                  - 80:80
                volumes:
                  - /home/admin/application/nginx/logs:/var/log/nginx/
            EOF
            cat > /etc/systemd/system/docker-compose-app.service <<EOF
            [Unit]
            Description=Docker Compose Application Service
            Requires=docker.service
            After=docker.service
            [Service]
            Type=oneshot
            RemainAfterExit=yes
            WorkingDirectory=/home/admin/application
            ExecStart=/usr/bin/docker compose up -d
            ExecStop=/usr/bin/docker compose down
            TimeoutStartSec=0
            [Install]
            WantedBy=multi-user.target
            EOF
            systemctl enable docker-compose-app
            # This command snippet runs before Docker Compose starts. You can reference parameters in the command.
            echo "before docker compose starts"
            mkdir -p /home/admin/application/nginx/logs
            systemctl start docker-compose-app
            sleep 10
            # This command snippet runs after Docker Compose starts. You can reference parameters in the command.
            echo "after docker compose starts"
            echo ${AdminPassword}
            # The callback is invoked when the script is successfully run, and WaitCondition no longer needs to wait for signals.
            ${CurlCli} -d "{\"Data\" : \"Success\", \"status\" : \"SUCCESS\"}"
          - CurlCli:
              Fn::GetAtt:
                - WaitConditionHandle
                - CurlCli
Outputs: 
  Endpoint:
    Value:
      Fn::Sub:
        - http://${Address}:80
        - Address:
            Fn::Select:
            - 0
            - Fn::GetAtt:
              - InstanceGroup
              - PublicIps
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - PayType
          - PayPeriodUnit
          - PayPeriod
        Label:
          default: Billing Configuration
      - Parameters:
          - EcsInstanceType
          - InstancePassword
        Label:
          default: Resource Configuration
      - Parameters:
          - AdminPassword
        Label:
          en: Software Configuration
          zh-cn: 软件配置
      - Parameters:
          - ZoneId
          - VpcId
          - VSwitchId
        Label:
          default: Zone Configuration

In the Deployment Package Association section, Set Container Image Association. Click Select Deployment Package. In the dialog box that appears, select the deployment package and version, and then click OK to associate the container image deployment package.
After you create and test the service, perform a self-check against the service release criteria and submit it for review. For more information, see Review criteria.
After the service is created, you can view the deployment package association on the service details page.

On the service details page, click the Deployment Package Association tab, and then the Container Image Association tab to view the association between the placeholder (such as {{ computenest::acrimage::nginx }}) and its corresponding deployment package information.

Compute Nest:Container Image Deployment Package