Docs

Container Registry

Instance management

Creating proxy cache registries

When a standard instance directly pulls overseas images, slow pulling or inaccessible connections may often occur. A proxy cache instance leverages the proxy cache's caching capability to enable nearby access, effectively improving image pull efficiency. This topic describes how to create a proxy cache registry.

tip

The Micro Edition supports both intranet and public network access by default, with no additional operation required. Private network connectivity is enabled by default within the same region. This avoids consuming public bandwidth and effectively improves the image pull speed.

Background

Proxy cache registries are used to proxy-caching external image sources (Docker Hub, GHCR, or self-hosted Docker Registry). Upon the first pull, images are automatically synced from the remote origin to local cache. Subsequent pulls directly hit the cache.

Proxy cache registries are available in Standard Edition and Micro Edition. You can select an appropriate instance type based on your business scale, performance requirements, and usage scenarios. For details of the instance specifications, see Instance types.

Application scenarios

When using Docker Hub or GHCR (GitHub Container Registry) sources, you may be unable to pull images directly due to network or other issues. CR supports pulling required images through a proxy cache registry, without changing the address of the image to be pulled.

Type	Proxy upstream	Application scenarios
Docker	Docker Hub official	Use a proxy to pull public or private images from Docker Hub, such as official images and community images like nginx and redis, solving the issues of slow Docker Hub access and inaccessibility in the Chinese mainland.
Docker Registry	Any self-hosted or third-party Docker Registry (compliant with the Docker Registry V2 protocol)	Use a proxy to pull images from private registries such as enterprise self-managed Harbor, AWS ECR, and Alibaba Cloud ACR. This is suitable for unified image access in cross-cloud or hybrid cloud scenarios.
GHCR registry	GitHub Container Registry (ghcr.io)	Use a proxy to pull container images managed on GitHub Packages (such as images released by open-source projects at ghcr.io/org/image).

Considerations

Proxy cache registries only allow pulling images from third-party image registries into CR and do not support proactively pushing images.

Only Standard Edition proxy cache registries support the Docker Registry type.

Prerequisites

A system account has been registered. For detailed operations, see How to register an account.

(Optional) You have created a Standard Edition proxy cache registry and completed enterprise account real-name authentication. For details, see Identity authentication.

Please ensure that your Volcano Engine account balance is not less than CNY 10. For details, see Billing center.

Operating Steps

Select the target region in the top navigation bar.

In the left navigation pane, click Instance list > Proxy cache. Then, on the right page, click Create proxy cache registry.

On the Create proxy cache registry page, enter the configuration information.

Parameter	Description
Domain name	Custom domain name for the proxy registry. The domain name is the access entry point of the registry, used for pushing, pulling, and managing container images.
Project	The associated target project. After association, members of the project will obtain corresponding permissions for the Container Registry based on project authorizations. For details, see Project management and Managing project authorization.
Billing type	Pay-as-you-go, which is a postpaid billing mode. You can enable and disable the resource at any time, where the billing will be based on your actual usage duration. For billing details, see Product billing.
Specification	Select Standard Edition or Micro Edition.
Proxy cache	Select the proxy cache registry type based on the type of image you need to pull. Pull Docker Hub images: Type: Select Docker. Image pull authentication: Enable authentication: After you enter the username and password used to log in to the target Docker Hub, you can pull images from non-official image registries (not the library registry). Disable authentication: Only pulling images from the official image registry (thelibrary registry) is allowed. Network acceleration: Enabled by default. To ensure pull quality, network acceleration is enabled by default. Cross-border network acceleration will incur origin pull traffic fees. For billing details, see Product billing. The fees displayed on the console shall prevail. Pull GitHub Container Registry images: Type: Select Ghcr registry. Image pull authentication: Enable authentication: After you enter the username and token used to log in to the third-party image registry, you can pull private images. Disable authentication: Only temporary access credentials obtained through https://ghcr.io/token can be used for pulling public images. Network acceleration: Enabled by default. To ensure pull quality, network acceleration is enabled by default. Cross-border network acceleration will incur origin pull traffic fees. For billing details, see Product billing. The fees displayed on the console shall prevail. Pull enterprise self-managed private images: Type: Docker Registry is selected by default. Access address: Enter the address of the proxy cache registry. The access address for the Docker Registry type can be changed. Username: Enter the username used to log in to the third-party image registry. Password: Enter the password used to log in to the third-party image registry. Ignore certificate validity period: Not ignored by default. You can choose to ignore the certificate validity of the access address.
Tag	Add tags to the instance. You can search for and select existing tags. You can also create custom ones if existing tags cannot meet your requirements. You can view billing information based on instance tags in the splitting bills. For details, see Splitting bills.
Server-side encryption	warning This feature is supported only for Standard Edition. After this feature is enabled, it cannot be disabled in the console. To disable it, submit a ticket. Existing instances do not support enabling this feature. To use this feature for existing data, create a new instance with encryption enabled. You can use the "Registry replication" feature to migrate data from an existing instance to a new instance, reducing migration costs. For detailed operations, see Inter-instance synchronization. Encryption and decryption of large images may cause some performance loss during push and pull operations. Enable this feature as needed. Whether to enable server-side encryption. After it is enabled, image data is encrypted and stored on the server side, complying with security compliance requirements for certain data. Enabled: Images uploaded are encrypted by default. Disabled: The default value. Encryption is not enabled.

View the instance specification comparison and configuration costs. After confirming that everything is correct, click Confirm Order.

On the Confirm order page, check the order information again, carefully read and check I have read and agree to the Container Registry Service Terms.

Click Confirm to submit the order and start creation.

What to do next

Pull proxy cache registry via a dedicated line: Some proxy cache registries do not support public network access and require connectivity through a dedicated line.

Last updated: 2026.09.23 14:37:24