Container Registry:What is Container Registry?

Container Registry Enterprise Edition

Container Registry Enterprise Edition provides a dedicated, resource-isolated registry instance with no shared infrastructure, delivering predictable performance and strong security boundaries.

Key characteristics:

• Dedicated instance with no shared resources
• 99.95% SLA with cross-zone high availability included by default in multi-zone regions
• Supports container images, Helm Charts (v2/v3), and any OCI-compliant artifact
• Configurable network access controls (VPC isolation, allowlists)
• Full audit trail via ActionTrail
• Available in Basic Edition and Advanced Edition tiers — compare in Specifications

Recommended for: Teams running production services on ACK or any Kubernetes-based environment.

Container Registry Personal Edition (for individuals)

Container Registry Personal Edition provides basic image hosting, image building, and image authorization services for individual developers and exploratory use.

Recommended for: Individual developers learning container workflows or experimenting with ACR features.

Artifact hosting

ACR stores multi-architecture container images (Linux, Windows, Arm), Helm Charts (v2/v3), and any Open Container Initiative (OCI) artifact. Tag immutability prevents accidental overwrites, and automated cleanup rules control storage consumption.

Accelerated distribution

Container Registry Enterprise Edition replicates images across Alibaba Cloud regions through global synchronization. The Advanced Edition adds P2P (peer-to-peer) distribution and on-demand distribution (lazy pulling) to accelerate large-scale deployments.

Pull throughput guarantees by edition:

Security and compliance

• Vulnerability scanning: Multi-engine scanning detects known CVEs in stored images before deployment.
• Vulnerability fixing: Enterprise Edition identifies fixable vulnerabilities and guides remediation.
• Threat blocking: Advanced Edition only. Automatically blocks images that violate your security policy from being pulled.
• Image signing: Advanced Edition only. Cosign-compatible signing and verification for supply chain security.
• Network access control: Restrict instance access to specific VPCs and CIDR ranges.
• Audit logging: All image push, pull, and management events are logged to ActionTrail for compliance reporting.
• Credential-free pull: Supported on Container Registry Enterprise Edition instances. Note: instances created on or after September 4, 2024 support credential-free pull on Enterprise Edition only; Container Registry Personal Edition instances created on or after that date do not support this feature.

Build and CI/CD integration

ACR builds container images from connected source repositories, with up to 10 concurrent builds on the Advanced Edition. Built images flow through your scan-and-sign workflow before reaching ACK clusters.

Artifact subscription and event notifications

Subscribe to upstream public repositories for automatic updates when new versions are published. Event notifications trigger deployment pipelines or alerts when images are pushed or scans complete.

Multi-region disaster recovery

Container Registry Enterprise Edition instances in multi-zone regions include cross-zone high availability by default. For cross-region disaster recovery, deploy separate instances per target region. Storage redundancy options include OSS zone-redundant storage (ZRS) for cross-zone protection and OSS cross-region replication (CRR) for cross-region backup.

CI/CD pipeline integration

Connect ACR to source repositories to build images on every commit. Vulnerability scanning runs after each build, and threat blocking rules prevent non-compliant images from reaching ACK clusters — creating an auditable path from source to production.

Multi-region and global deployments

Replicate images from a primary region to secondary regions with global synchronization rules. Combined with P2P distribution (Advanced Edition), this reduces pull times across geographically distributed Kubernetes clusters.

Enterprise security and compliance

Restrict registry access to specific VPCs, enforce tag immutability, sign images with Cosign, and verify signatures at deployment. Export ActionTrail logs to your SIEM for compliance reporting.

Migration from self-managed registries

Import images from Harbor to Container Registry Enterprise Edition without re-pushing through a local client. Artifact subscription replaces manual sync scripts for external public images.

Quotas

Distribution and security

Disaster recovery