Add a Sidecar container

Serverless App Engine (SAE) supports adding Sidecar containers to your applications to enhance the functionality of the main application container. Sidecar containers can implement decoupling and standardization of non-business functions such as monitoring and log collection. This approach separates auxiliary tasks from the main application container, allowing it to focus more on core business logic.

Before you start

SAE supports pulling target images from various image repositories. The prerequisites for pulling images vary depending on the repository type. Complete the necessary preparations according to your needs.

Pull images from the ACR repository of the current Alibaba Cloud account:
- Activate Container Registry.
- Create images and push them to the Alibaba Cloud ACR image repository. For more information, see the following documents:
  - Image creation examples.
  - Build images by using Enterprise Edition instances or Push and pull images by using Personal Edition instances.
Pull images from third-party image repositories:
- Create images and push them to the target image repository. For information about how to create images, see Image creation examples.
- Make sure that the target image repository can be accessed over the Internet. For more information, see Configure NAT Gateway to enable SAE applications to access the Internet.
Pull images from ACR repositories of other Alibaba Cloud accounts:
- Make sure that the image of the main application container is pulled from the ACR repository of another Alibaba Cloud account.
- Make sure that the image of the Sidecar container is pulled from the ACR repository of the same Alibaba Cloud account as the main application container image.

Feature entry

The feature entry varies in different scenarios. You can add a Sidecar container during:

Application creation.
Application deployment.

During application creation

Log on to the SAE console, choose Applications > Applications in the left-side navigation pane, select the destination region and namespace, and then click Create Application.
On the Basic Information page, configure the parameters and click Next: Advanced Settings.
Expand the Add a Sidecar container section, and then click Add.

During application deployment

Warning

After you redeploy an application, the application is restarted. To prevent unpredictable errors such as business interruptions, we recommend that you deploy applications during off-peak hours.

Log on to the SAE console, choose Applications > Applications in the left-side navigation pane, select the destination region and namespace, and then click the name of the target application.
On the Basic Information page of the target application, click Deploy Application.
On the Deploy Application page, expand the Add a Sidecar container section, and then click Add.

In the Sidecar Container panel that appears, configure the following parameters and click OK.

Configure the Container Name for the Sidecar.
Configure the address for pulling the image.
This topic uses the Nginx image as an example.
Images of Current Alibaba Cloud Account
You can pull images from Container Registry Personal Edition or Container Registry Enterprise Edition.
- Container Registry Personal Edition: You need to select the Image Repository Namespace and the specific Image Version.
- Container Registry Enterprise Edition: You need to select the Enterprise Edition Instance, Image Repository Namespace, and the specific Image Version.
Custom images
You can pull images from third-party image repositories and private image repositories of other Alibaba Cloud accounts.
- Pull images from third-party image repositories:
  Enter the complete image repository address and ensure that the repository is accessible over the Internet.
  The format of the image repository address is <image name>:<image tag>, for example: registry.openanolis.cn/******/nginx:1.14.1-8.6.
  Important
  By default, SAE applications cannot access resources and services on the Internet, so they cannot pull images from public image repositories. To solve this problem, you need to enable NAT Gateway for the VPC where the application is located. For more information, see Configure NAT Gateway to enable SAE applications to access the Internet.
- Pull images from private image repositories of other Alibaba Cloud accounts:
  If the image of the main application container is pulled from a private repository of another Alibaba Cloud account, the Sidecar container also supports pulling images from private image repositories of other Alibaba Cloud accounts, and will automatically reuse the acrAssumeRoleArn and secret of the main application image.
  The format of the image repository address is <image repository endpoint>:<image version>, for example: registry.cn-beijing.aliyuncs.com/sae-demo-******:nginx.
Set the Maximum number of CPU resources and Maximum number of memory resources for the Sidecar Container.
Note
Sidecar containers share CPU and memory resources with the main application container. To ensure the normal operation of the main container, set reasonable resource limits for the Sidecar container to prevent it from consuming excessive resources.
(Optional) Click Advanced Settings to configure the following parameters for the Sidecar container as needed.
1. In the Startup Command section, configure the startup command for the Sidecar container. For more information, see Configure startup commands.
2. In the Environment Variables section, configure the variables that need to run in the Sidecar container environment. For more information, see Configure environment variables.
3. In the Configuration Management section, inject the required configuration information into the Sidecar container by mounting ConfigMap configuration files. For more information, see Inject configuration information.
4. In the Shared Temporary Storage section, set up a temporary storage directory and mount it to both the main application container and the Sidecar container.
  Note
  The temporary storage name can only contain lowercase letters, numbers, and hyphens (-).

Verification

On the Log Management > Real-time Logs page, you can view the real-time logs of both the main application container and the Sidecar container.
On the Instances page, use Webshell to log on to the container. On the Webshell page, you can view detailed information about the main application container and the Sidecar container.
Check whether the test directory exists in the /tmp directory of both the main application container and the Sidecar container.