Deploy an application by using an image from an ACR instance in a different account - Serverless App Engine

If your Serverless App Engine (SAE) application and Container Registry (ACR) instance are in different Alibaba Cloud accounts, first ensure network connectivity. Then, configure authorization to access the ACR instance. Finally, provide the image repository address to deploy the application.

Prerequisites

Ensure network connectivity for SAE and ACR

You must either establish cross-VPC connectivity or enable a public NAT gateway for your application's Virtual Private Cloud (VPC). For ACR Enterprise Edition instances, you must also add the CIDR block of the SAE application's VPC or the Elastic IP Address (EIP) bound to the NAT gateway to the ACR instance's whitelist.

How to view the VPC of an SAE application

The application's region and namespace determine its VPC.

Log on to the SAE console, select a region, and choose Namespaces.
Click the target namespace, choose Basic Information, and click the VPC link to view the VPC ID.

Configure ACR access authorization

You can use either Static Username and Password or a RAM Role.

Static username and password

Create a Secret to store the username and password for the image repository. On the Namespace page, select a region, click the target namespace, choose Secret in the left-side navigation pane, and then click Create.

Set Type to Private Image Repository Logon Key.
In the Image Repository Address field, enter the public domain of the ACR instance. For example, registry.cn-xx.aliyuncs.com for Container Registry Personal Edition or xx-registry.cn-xx.cr.aliyuncs.com for ACR Enterprise Edition. Enter the Username and Password to log on to the image repository.

How to find the username and password to log on to the image repository

For Container Registry Personal Edition, log on to the account that owns the ACR instance. On the ACR Personal Edition Instance - Access Credential page, select the instance's region to view the Username and modify the Password.

This page contains the Get Credential and Log On To Instance sections. In the Get Credential section, click Set Fixed Password to set a permanent access credential. In the Log On To Instance section, select the access domain for your network environment (VPC, public network, or classic network). Then, run the command sudo docker login --username=<username> registry.cn-shenzhen.aliyuncs.com in a terminal to log on to the registry instance.
For ACR Enterprise Edition, log on to the account that owns the ACR instance and see Configure access credentials to find the username and password.

In the left-side navigation pane, choose Instance Management > Access Credential. On the Account Access Credential Management tab, obtain credentials by either setting a fixed password or getting a temporary password. After obtaining the credentials, use the following command to log on to the instance: sudo docker login --username=<username> registry-vpc.cn-hangzhou.cr.aliyuncs.com. You can find the value for --username on this page.

RAM role

SAE can pull images from an ACR instance in another account by assuming a RAM role. For example, an application in Account A can assume a RAM role in Account B to pull images from an ACR instance owned by Account B.

Create a RAM role: Use Account B to create a RAM role for Account A. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

Configure an access policy: Create a custom policy or modify a custom policy to include the following statements to allow operations on private images.

{
  "Version": "1",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "cr:GetAuthorizationToken",
              "cr:ListInstanceEndpoint",
              "cr:PullRepository",
              "cr:GetRepository",
              "cr:ListRepositoryTag"
          ],
          "Resource": "*"
      }
  ]
}

Grant permissions to the RAM role: Grant the access policy from Step 2 to the RAM role from Step 1. For more information, see Manage RAM role permissions.

Modify the trusted entity of the RAM role: Change the trusted entity of the RAM role from Step 1 to the SAE service account by modifying the trust policy. For more information, see Modify the trust policy of a RAM role.

Before

After

{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::123456789012****:root"
                ]
            }
        }
    ],
    "Version": "1"
}

This RAM role can be assumed by any authorized RAM user or RAM role under the Alibaba Cloud account (AccountID=123456789012****).

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "123456789012****@sae.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

This RAM role can only be assumed by the SAE service account (123456789012****@sae.aliyuncs.com) for the Alibaba Cloud account (AccountID=123456789012****).

Note

In this example, Service refers to the service that pulls the image.

Copy the ARN: On the Basic Information page of the RAM role, copy the ARN. You will need this value for the acrAssumeRoleArn field when deploying the application.

Procedure

On the SAE Application List page, select a region and namespace, then click Create Application.
Select an application edition.

Important
Lightweight Edition and Professional Edition are invite-only. If you are not in the beta, your application defaults to Standard Edition and no edition selection is required.
- Lightweight Edition: Minimum feature set. Does not support Application Monitoring or Microservices Governance.
- Standard Edition: Includes Basic Application Monitoring. Advanced Application Monitoring and Microservices Governance must be enabled and purchased separately.
- Professional Edition: Includes Advanced Application Monitoring and Microservices Governance — no separate enablement or purchase required.
On the Create Application page, specify an Application Name and configure the following parameters.
1. Select a namespace type. Namespaces isolate resources across environments and cannot be changed after creation.
  - System Created: Uses the default namespace, vSwitch, and security group automatically created in the current region.
  - Existing Namespace: Select a namespace, vSwitch, and security group that you created in advance.
2. Set Application Deployment Method to Select Image Deployment, and then click Specify Image on the right. On the Private Images of Other Alibaba Cloud Account tab, configure the following parameters.
  - Select your ACR edition, and then choose an authorization method. For ACR Enterprise Edition, you must also enter the Enterprise Edition Instance ID.
    
    Static Username and Password: Select the Secret for Username and Password of Image Repository that you created earlier.
    
    RAM Role: Enter the acrAssumeRoleArn that you copied earlier.
  - Enter the Complete Image Repository Address in the format <image-repository-address>:<image-tag>. For example: registry.cn-xx.aliyuncs.com/xx/xx:1.0 for Container Registry Personal Edition, or xx-registry.cn-xx.cr.aliyuncs.com/xx/xx:1.0 for ACR Enterprise Edition.Note: Use the public or private image repository address that corresponds to your network configuration.
  - For ACR Enterprise Edition, you can enable image acceleration to speed up application startup.
3. In the Capacity Settings section, configure Resource Type, Single Instance Specification, and Number of Instances.
(Optional) Click Next: Advanced Settings to configure additional features.
- Startup command
  
  The image's CMD or ENTRYPOINT determines the startup command — no extra configuration is needed. To override it, set a startup command in SAE.
- Runtime environment and lifecycle management
  Update variables or config files without rebuilding the image: setting environment variables, setting host bindings, injecting configurations, and injecting secrets.
  
  Configure a health check to monitor instances. Unhealthy instances are restarted and withheld from traffic until they pass.
  
  Use application lifecycle management to run custom commands on startup and shutdown, and enable graceful shutdown.
- Network access and service invocation
  Enable inter-application service calls through service registration and discovery. MSE-based service discovery incurs additional fees.
  
  Expose your application by binding an NLB, binding a CLB, or configuring a gateway route. NLB, CLB, and gateway routes incur additional charges.
  
  Enable outbound access by configuring a NAT Gateway or binding an EIP to an application instance. NAT Gateway and EIP incur additional charges.
- Data persistence
  
  Persist application data in NAS, OSS, or a database to prevent data loss on updates or stops. NAS, OSS, and databases incur additional charges.
- Logging and monitoring
  After deployment, view real-time logs and monitor resource usage and load without extra configuration. Export logs to SLS or Kafka. SLS and Kafka incur additional charges.
  
  ARMS monitoring provides full-stack observability — identify faulty or slow API calls, detect bottlenecks, and reproduce call parameters for troubleshooting.
  
  For Standard Edition, basic ARMS monitoring is available after deployment without extra configuration. You can purchase and enable advanced ARMS monitoring.
  
  For Professional Edition, enable Application Monitoring in Advanced Settings to access advanced ARMS monitoring at no additional cost.
- Other features
  Microservices Governance provides Java applications with graceful start and shutdown, traffic protection, end-to-end canary release, and prioritized routing to providers in the same zone.
  
  For Standard Edition, purchase and enable MSE Microservices Governance from the application details page after deployment.
  
  For Professional Edition, enable Microservices Governance in Advanced Settings to configure graceful start and shutdown. Configure other features on the application details page after deployment. No additional fees.
  
  Enable the CPU Burst feature to handle peak CPU demand during startup and loading without over-provisioning.
  
  Add a sidecar container to separate non-business functions from the main application container.
Click One-Click Create Application or Create Application.
- Creation takes 1–2 minutes. View the change records to verify deployment status. If deployment fails, no instances are created — check the error in Change Details.
- View created applications on the page. To modify configuration, open the application details page and click Deploy Application or Modify Application Configurations. The application restarts to apply changes — do this during off-peak hours.
- You can log on to an application instance by using Webshell to run console commands.
- After creation, manually adjust the number of instances and the instance specification, or configure an auto scaling policy. Enable idle mode to reduce costs.