Security Center:Add image repositories to Security Center

Before you begin: network access requirements

If your third-party repository has an IP allowlist, add the Security Center IP addresses for the region where your repository is hosted.

Set up traffic forwarding (VPC-connected data centers only)

If your third-party image service runs in an on-premises data center connected to Alibaba Cloud over a VPC, Security Center cannot reach it directly. Use an Elastic Compute Service (ECS) instance as a traffic forwarder: Security Center connects to the ECS instance, which forwards requests to your on-premises registry server.

The commands below forward traffic on Port A of the ECS instance to Port B of the on-premises server at 192.168.XX.XX.

CentOS 7 — firewall-cmd

firewall-cmd --permanent --add-forward-port=port=<Port A>:proto=tcp:toaddr=<192.168.XX.XX>:toport=<Port B>

CentOS 7 — iptables

Run the following two commands in order:

1. Enable IP forwarding:

   echo "1" > /proc/sys/net/ipv4/ip_forward

2. Configure port forwarding with DNAT:

   iptables -t nat -A PREROUTING -p tcp --dport <Port A> -j DNAT --to-destination <192.168.XX.XX>:<Port B>

Windows

netsh interface portproxy add v4tov4 listenport=<Port A> listenaddress=* connectaddress=<192.168.XX.XX> connectport=<Port B> protocol=tcp

Replace <Port A>, <192.168.XX.XX>, and <Port B> with the actual port and IP values for your environment.

Steps

1. Log in to the Security Center console. In the top navigation bar, select the region of the assets you want to manage: China or Outside China.Log on to the Security Center console.

2. In the left-side navigation pane, choose Assets > Container.

3. On the Container page, click the Image tab, then click Add below Add Third-party Image Repository.

   

4. In the Add Image Repository panel, configure the following parameters, then click Next.

   Parameter	Description
   Private Repository Type	The registry type. Valid values: harbor, quay, gitlab.
   Version	The registry version. V1 for version 1.X.X; V2 for version 2.X.X or later. GitLab defaults to V1 and cannot be changed.
   Communication Type	The protocol Security Center uses to connect to the registry. Valid values: http, https.
   Network Type	Internet or VPC.
   RegionId	The region where the third-party repository is hosted.
   IP	The IP address of the repository. If you set up traffic forwarding, enter the IP address of the ECS instance instead.
   Port	The port number. If you set up traffic forwarding, enter the port on the ECS instance (Port A) instead.
   Domain Name	The domain name of the repository.
   Speed Limit	The maximum number of images to sync per hour. Default: 10. Setting this to Unlimited may affect your services — keep the default unless your environment can handle higher throughput.
   Username	The username of the account that has administrative rights and is used to access the third-party image repository.
   Password	The password of the account.
   Quay Namespace Information	(Quay only) Enter the Image Repository Organization name and the corresponding Auth_token. Click Add to include multiple organizations.
   GitLab Group Information	(GitLab only) Enter the Group Information name and the corresponding Access_token. Click Add to include multiple groups.

After the repository is added, verify the connection by navigating to Protection Configuration > Container Protection > Container Image Scan in the left-side navigation pane and clicking Scan Settings in the upper-right corner.