Platform For AI:Deploy model services using custom images

Step 1: Prepare environment

Prerequisites:

• Virtual Private Cloud (VPC): EAS service, ECS instance, and ACR registry must use same VPC for stable, secure image transfers.

• Container Registry (ACR): ACR Enterprise Edition instance with configured namespace and image repository. See Use an Enterprise Edition instance to push and pull images.

• Development environment: ECS instance with Docker installed and this configuration:

  • Instance type: ecs.u1-c1m2.large

  • Image: Alibaba Cloud Linux 3.2104 LTS 64-bit

  • Extension: Docker Community Edition

  • Network: ECS instance VPC must be added to ACR Enterprise Edition instance access control list. See Configure access control for an ACR instance over a VPC.

  Note

  Alternative development environments:

  • Local development: Install Docker to build images locally.

  • DSW development: In Actions column, click Create Image to build and save image to ACR. During EAS deployment, select Custom Image from dropdown. See Create a DSW instance image.

Step 2: Create application files

Create a project folder named my-app with three files:

1. requirements.txt (Application dependencies)

   flask
   gunicorn

2. app.py (Web application code)

   from flask import Flask
   
   app = Flask(__name__)
   
   @app.route('/hello/model')
   def hello_world():
       # Replace with model inference or business logic
       return 'Hello World from Gunicorn!'
   
   # Gunicorn starts application (app.run() not needed)

3. Dockerfile (Image build instructions)

   # 1. Use official lightweight Python image as base
   FROM python:3.9-slim
   
   # 2. Set working directory
   WORKDIR /app
   
   # 3. Copy requirements and install dependencies (leverages Docker cache)
   COPY requirements.txt .
   RUN pip install --no-cache-dir -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
   
   # 4. Copy application code
   COPY app.py .
   
   # 5. Expose service port
   EXPOSE 8000
   
   # 6. Define container start command (override with "Command" in EAS console)
   CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:8000", "app:app"]

Step 3: Build and push image

1. Navigate to project folder (my-app).

2. Log in to ACR. Replace placeholders with your ACR credentials.

   # Example: docker login --username=your_user my-registry.cn-hangzhou.aliyuncs.com
   docker login --username=<username> <ACR_repository_domain_name>

3. Build and tag the image.

   # Example: docker build -t my-registry.cn-hangzhou.aliyuncs.com/my-namespace/flask-app:v1 .
   docker build -t <ACR_repository_domain_name>/<namespace>/<image_repository_name>:<version_number> .

4. Push the image to ACR.

   # Example: docker push registry.cn-hangzhou.aliyuncs.com/my-namespace/flask-app:v1
   docker push <ACR_repository_domain_name>/<namespace>/<image_repository_name>:<version_number>

Step 4: Deploy service

1. Log on to the PAI console. Select a region on the top of the page. Then, select the desired workspace and click Elastic Algorithm Service (EAS).

2. Click Deploy Service and select Custom Model Deployment > Custom Deployment.

3. Configure parameters:

   • Deployment Method: Select Image-based Deployment.

   • Image Configuration: Select Image Address and enter the full image address.

     Authentication is unnecessary when ACR and EAS belong to the same Alibaba Cloud account.

   • Command to Run: gunicorn -w 4 -b 0.0.0.0:8000 app:app

     Console commands override Dockerfile CMD. Specify the command here for easier runtime debugging and modification.

   • Port Number: 8000.

   • Deployment: Select CPU resource like ecs.c6.large from Public Resources.

   • VPC: Select VPC, vSwitch, and security group for the service.

     VPC must be added to ACR instance access control list. Missing configuration causes ImagePullBackOff errors during deployment.

4. Click Deploy. Service status changes to Running after successful deployment.

Service fails with ImagePullBackOff error

ImagePullBackOff error indicates EAS cannot pull the container image from the registry. Common causes:

1. Network connectivity

   EAS service's VPC must have network connectivity to the image registry.

   • Action: Verify EAS service's VPC is added to ACR instance access control list.

   • Cross-region deployments: Connect VPCs across regions using Cloud Enterprise Network (CEN). See Access an ACR Enterprise Edition instance across regions or from an IDC.

   • Public internet pulls: Ensure VPC has a NAT Gateway configured and public network access is enabled for ACR repository.

2. Authentication failure

   Private registries require authentication credentials. ACR instances in the same account automatically authenticate without credentials.

   • Action: Verify username and password in Image Configuration are correct and have pull permissions for the repository.

3. Image not found

   Image path or tag is incorrect, or the image doesn't exist in the registry.

   • Action: Verify image address, namespace, and tag match the values you used when pushing to the registry.

4. Insufficient disk space

   Node's local storage is full and cannot store the pulled image.

   • Action: Expand the system disk for EAS service resource group.