Deploy applications using images from non-ACR repositories - Serverless App Engine

In addition to ACR, you can deploy applications by using images from any third-party image repository, such as Docker Hub or Docker Registry. To do this, you must ensure network connectivity between your SAE application and the image repository, configure credentials to access the repository, and then provide the image repository address to deploy the application.

Prerequisites

Ensure network connectivity to the image repository

If the image repository is in the same VPC as your SAE application, no additional network configuration is required.
If the image repository is not in the VPC of your SAE application, you must establish a cross-VPC connection or enable a NAT Gateway for the application's VPC. If the image repository has access restrictions, you must also add the CIDR block of the application's VPC or the Elastic IP Address (EIP) bound to the NAT Gateway to the repository's allowlist.

How to view the VPC of an SAE application

The application's region and namespace determine its VPC.

Log on to the SAE console, select a region, and choose Namespaces.
Click the target namespace, choose Basic Information, and click the VPC link to view the VPC ID.

What if my SAE application is in a Chinese mainland region and cannot access an overseas image repository like Docker Hub?

Option 1: Domestic repository

Image repositories in the Chinese mainland, such as the ACR Artifact Center, may contain the image you want to deploy. For example, the address for an Nginx image is registry.openanolis.cn/openanolis/nginx:1.14.1-8.6.

Option 2: Overseas image via ACR

Pull the overseas image to your local machine, push it to ACR, and then deploy the application using an image from an ACR instance that belongs to the same account or an ACR instance that belongs to a different account.

Configure repository credentials

Create a secret to store the username and password for the image repository. On the Namespaces page, select the target region and click the target namespace. In the left-side navigation pane, choose Secrets, and then click Create.

For Type, select Image Repository Credentials.
Enter the IP address or domain name of the image repository.
Enter the Username and Password required to log on to the image repository.

Procedure

On the SAE Application List page, select a region and namespace, then click Create Application.
Select an application edition.

Important
Lightweight Edition and Professional Edition are invite-only. If you are not in the beta, your application defaults to Standard Edition and no edition selection is required.
- Lightweight Edition: Minimum feature set. Does not support Application Monitoring or Microservices Governance.
- Standard Edition: Includes Basic Application Monitoring. Advanced Application Monitoring and Microservices Governance must be enabled and purchased separately.
- Professional Edition: Includes Advanced Application Monitoring and Microservices Governance — no separate enablement or purchase required.
On the Create Application page, specify a custom Application Name and configure the following parameters.
1. Select a namespace type. Namespaces isolate resources across environments and cannot be changed after creation.
  - System Created: Uses the default namespace, vSwitch, and security group automatically created in the current region.
  - Existing Namespace: Select a namespace, vSwitch, and security group that you created in advance.
2. Set Application Deployment Method to Select Image Deployment, and then click Specify Image on the right. On the Custom Image tab, configure the following settings.
  - Select Public Network or Private Network to access the image repository based on your network configuration.
  - If the image repository requires a username and password, select the Secret for Username and Password of Image Repository that you created earlier.
  - Enter the full Image address in the format <Image repository public or private address>:<Image Tag>, for example, nginx:1.23.1.
3. In the Capacity Settings section, configure Resource Type, Single Instance Specification, and Number of Instances.
(Optional) Click Next: Advanced Settings to configure additional features.
- Startup command
  
  The image's CMD or ENTRYPOINT determines the startup command — no extra configuration is needed. To override it, set a startup command in SAE.
- Runtime environment and lifecycle management
  Update variables or config files without rebuilding the image: setting environment variables, setting host bindings, injecting configurations, and injecting secrets.
  
  Configure a health check to monitor instances. Unhealthy instances are restarted and withheld from traffic until they pass.
  
  Use application lifecycle management to run custom commands on startup and shutdown, and enable graceful shutdown.
- Network access and service invocation
  Enable inter-application service calls through service registration and discovery. MSE-based service discovery incurs additional fees.
  
  Expose your application by binding an NLB, binding a CLB, or configuring a gateway route. NLB, CLB, and gateway routes incur additional charges.
  
  Enable outbound access by configuring a NAT Gateway or binding an EIP to an application instance. NAT Gateway and EIP incur additional charges.
- Data persistence
  
  Persist application data in NAS, OSS, or a database to prevent data loss on updates or stops. NAS, OSS, and databases incur additional charges.
- Logging and monitoring
  After deployment, view real-time logs and monitor resource usage and load without extra configuration. Export logs to SLS or Kafka. SLS and Kafka incur additional charges.
  
  ARMS monitoring provides full-stack observability — identify faulty or slow API calls, detect bottlenecks, and reproduce call parameters for troubleshooting.
  
  For Standard Edition, basic ARMS monitoring is available after deployment without extra configuration. You can purchase and enable advanced ARMS monitoring.
  
  For Professional Edition, enable Application Monitoring in Advanced Settings to access advanced ARMS monitoring at no additional cost.
- Other features
  Microservices Governance provides Java applications with graceful start and shutdown, traffic protection, end-to-end canary release, and prioritized routing to providers in the same zone.
  
  For Standard Edition, purchase and enable MSE Microservices Governance from the application details page after deployment.
  
  For Professional Edition, enable Microservices Governance in Advanced Settings to configure graceful start and shutdown. Configure other features on the application details page after deployment. No additional fees.
  
  Enable the CPU Burst feature to handle peak CPU demand during startup and loading without over-provisioning.
  
  Add a sidecar container to separate non-business functions from the main application container.
Click One-Click Create Application or Create Application.
- Creation takes 1–2 minutes. View the change records to verify deployment status. If deployment fails, no instances are created — check the error in Change Details.
- View created applications on the page. To modify configuration, open the application details page and click Deploy Application or Modify Application Configurations. The application restarts to apply changes — do this during off-peak hours.
- You can log on to an application instance by using Webshell to run console commands.
- After creation, manually adjust the number of instances and the instance specification, or configure an auto scaling policy. Enable idle mode to reduce costs.