Docs

Container Registry

Registry replication

Synchronizing external repositories to CR

This topic describes how to use the registry replication feature to migrate an external repository to a Volcano Engine CR Standard Edition instance.

Background

CR allows you to migrate repositories external to Volcano Engine to Standard Edition instances with one click. This provides you with professional and stable hosting services and technical support, reduces the O&M and management costs associated with self-built and self-managed environments, and meets the delivery requirements of low-complexity businesses.

warning

Recently, access to Docker Hub has been unavailable in the Chinese mainland. This means that Docker Hub images cannot be directly migrated to CR instances in Chinese mainland regions using registry replication rules.

Currently, CR supports the proxy cache feature, enabling migration of Docker Hub images to CR.

Pull Docker Hub images via proxy cache registry domain name

Pull a Docker Hub image via the Docker Hub domain name

Limits

Currently, the following external repositories can be migrated: Tencent Cloud TCR Enterprise Edition, Alibaba Cloud ACR, AWS ECR private repositories, Harbor instances, Docker Hub, Google Artifact Registry (GAR), and Docker Registry instances.

Make sure that images can be pulled from and pushed to the external repositories as expected over the public network. Currently, only synchronization over the public network is supported for external images.

The migration success rate is not guaranteed when external image repositories from regions outside of China are migrated to CR instances in the Chinese mainland regions.

Prerequisites

The source instance and the target instance are in Running state.

The address, username, password, and other relevant information for the external repository are prepared.

Procedure

Step 1: Configure a registry replication rule

In the left navigation pane, select Registry replication, and click Create registry replication rule.

On the Create registry replication rule page, configure the parameters based on your needs.

Registry replication type

Parameter
Description
Synchronization type
Select External migration to migrate external repositories to Volcano Engine CR Standard Edition instances.

Basic information

Parameter
Description
Name
The custom name of the registry replication rule. The name must be unique within the same account.

Source/Target instance configuration

tip

Currently, the following external repositories can be the migration source: Tencent Cloud TCR Enterprise Edition, Alibaba Cloud ACR, AWS ECR private repositories, Harbor instances, Docker Hub, GAR, and Docker Registry instances.

Source instance

Tencent Cloud - Enterprise Edition

Alibaba Cloud

Harbor

AWS

Docker

Docker Registry

Google Cloud

tip

Only Tencent Cloud TCR Enterprise Edition can be migrated to Volcano Engine CR.

Parameter	Description
Service address	The external source repository service address starting with http(s)://. For example, https://test-sync.tencentcloudcr.com.
Access Key ID	Enter the SecretId from Access Management > API Key Management in the Tencent Cloud console.
Secret Access Key	Enter the SecretKey from Access Management > API Key Management in the Tencent Cloud console.
Repository type	Synchronization is only supported for artifacts in image repositories, not for those in Chart repositories.
Namespace	The name of the namespace to be synchronized from Tencent Cloud TCR. Click Enter to confirm the namespace.
Repository	The OCI artifact repository in the namespace of the external source repository to be synchronized. All: Synchronize all OCI artifact repositories in the specified namespace. Regular expression matching: Match the OCI artifact repositories to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.
Tag	The OCI artifact tags to be synchronized. All: Synchronize all OCI artifact tags in the specified repository. Regular expression matching: Match the OCI artifact tags to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.

warning

Docker Hub imposes image pull rate limits on free users. Exceeding such limits may result in synchronization failures. The recommended configuration methods are as follows:

Use exact regular expression matching instead of fuzzy matching to avoid pulling unnecessary images. For example, enter nginx in the Repository field. In the Tag field, select "Regular expression matching" and enter ^v1.0.0$ .

Set the synchronization interval to longer than 6 hours to prevent rate limiting caused by frequent image pulls.

Parameter	Description
Access address	This parameter is fixed as https://hub.docker.com.
Username	The username for logging in to the Docker Hub repository. warning You need to use the registered username of the Docker Hub repository to log in. Logging in with an email address is not supported.
Password	The password for logging in to the Docker Hub repository.
Type	Public repositories and personal repositories can be synchronized: library: Synchronize public Docker Hub repositories to obtain base images such as nginx and ubuntu. Personal repository: Synchronize Docker Hub repositories in your personal account.
Namespace	The name of the namespace to be synchronized from the Docker repository. library (public repository): Fixed as library. Personal repository: Corresponds to an account and its associated organization in Docker Hub.
Repository	The OCI artifact repository in the namespace of the external source repository to be synchronized. library (public repository): Only exact matching of repository names is supported. Enter the correct name of the public repository, such as nginx, ubuntu, python, or redis. Personal repository: All: Synchronize all OCI artifact repositories in the specified namespace. Regular expression matching: Match the OCI artifact repositories to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.
Tag	The OCI artifact tags to be synchronized. library (public repository): latest: The latest tag of the OCI artifact. By default, the latest tag is synchronized. Regular expression matching: Match the OCI artifact tags to be synchronized by entering a regular expression rule. You can enter .* to synchronize all tags. For configuration details, see Regular expression matching examples. Personal repository: All: Synchronize all OCI artifact tags in the specified repository. Regular expression matching: Match the OCI artifact tags to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.

Target instance

Parameter	Description
Instance name	Select the target Standard Edition instance in CR. The external repository will be synchronized to this Standard Edition instance.
Namespace	Select the target namespace in the Standard Edition instance. warning If you do not configure this parameter, synchronization will default to the namespace that has the same name as the namespace in the source repository. If you do not configure this parameter and a namespace with the same name does not exist, a namespace with the same name will be created by default in the target instance. If the source instance is of the Docker type and library is selected, synchronization defaults to the library namespace. If the library namespace does not exist, it will be created by default.

Synchronization rules

Parameter	Description
Image overwriting	You can select "Enable" to enable this feature. When this feature is enabled, if an image with the same name as an image in the external repository exists in the target Standard Edition instance, the image from the external repository will overwrite the existing image with the same name in the target instance.
Rule state	You can select "Enable" to enable the rule and configure the following trigger conditions based on your needs: Timed trigger: Synchronization is triggered at the configured fixed intervals, with the first synchronization time set by the user. First trigger time: Take note that this parameter can only be set to any time starting from the current time. Trigger frequency: Specify the synchronization interval. By default, synchronization is triggered every 24 hours. The valid interval ranges from 1 to 720 hours. Manual trigger: If this option is selected, the rule will not be triggered automatically and synchronization must be executed manually.

Step 2: Execute the registry replication rule

The following two trigger methods are supported:

If you select Timed trigger when you configure the registry replication rule, the system will automatically trigger synchronization at scheduled intervals.

tip

You can also manually trigger a timed trigger registry replication rule.

If Manual trigger is selected, you can manually trigger the rule by referring to the following steps:

In the left navigation pane of the CR console, select Registry replication.

On the Registry replication page, locate the rule to be triggered, and click Trigger in the Actions column.

In the system pop-up dialog box, verify the rule information, and click Confirm to trigger the synchronization operation.

Step 3: View synchronization logs

In the left navigation pane of the CR console, select Registry replication.

On the Registry replication page, locate the target rule and click the rule name.

On the rule details page, click the Synchronization log tab to view all synchronization logs of the rule.

Parameter	Description
Task ID	The synchronization task ID (unique within the instance).
Synchronization state	The task state, which can be Running, Succeed, and Failed. tip If the synchronization state is Succeed, the synchronization task is triggered as expected and at least one OCI artifact tag is synchronized. If the synchronization state is Failed, the task fails to be triggered. Possible causes: The network between CR and the external source repository is unreachable. The address of the external source repository does not exist. The username or password for the external source repository is incorrect. The password for the external source repository has expired. The namespace in the target Standard Edition instance does not exist. The target Standard Edition instance is not in Running state.
Task duration	The time consumed to complete all synchronization tasks.
Success rate	(Number of synchronized tags/Total number of tags to be synchronized) × 100%
Number of synchronization repositories	The number of OCI artifact repositories to be synchronized by the current task.
Trigger time	The trigger time of the synchronization task.

Click the task ID to view the details of the synchronization task. The following information is displayed: [namespace]/[repo]:tag of the source instance, [namespace]/[repo]:tag of the target instance, and synchronization state of the synchronization task.

If the synchronization state is Succeed, the artifacts have been successfully synchronized from the source instance to the target instance. If the synchronization state is Failed, the artifacts fail to be synchronized from the source instance to the target instance.

Last updated: 2026.09.23 14:37:22

Parameter	Description
Service address	Enter the service address of the source instance.
Ignore certificate validity	Whether to skip the validation of SSL/TLS certificate validity to avoid errors.
Image pull authentication	Whether to enable authentication for image pulling. To pull private images, you need to enable authentication and enter the username and password.
Username	Enter the username for logging in to the repository.
Password	Enter the password for logging in to the repository.
Namespace	Enter the name of the namespace to be synchronized from the repository. warning You can enter only one namespace for each rule.
Repository	Enter the OCI artifact repository in the namespace of the external source repository to be synchronized. You can enter multiple OCI artifact repositories.
Tag	Enter the OCI artifact tags to be synchronized. All: Synchronize all OCI artifact tags in the specified repository. Regular expression matching: Match the OCI artifact tags to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.

Parameter	Description
Service address	The external source repository service address starting with http(s)://. For example, https://southamerica-west1-docker.pkg.dev.
Username	It is automatically obtained. You do not need to enter it.
Access key	The Google Cloud Platform (GCP) access key. Create a service account and generate a key on the GCP Service Accounts page. You must obtain at least the Artifact Registry Reader role and add the resourcemanager.projects.get permission.
Repository type	This parameter is fixed as Image.
Namespace	The namespace in the GAR project, corresponding to the code repository in GAR.
Project name	Enter the project name in GCP.
Repository	The images to be synchronized. All: Synchronize all images in the specified namespace. Regular expression matching: Match the images to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.
Tag	The image tags to be synchronized. All: Synchronize all image tags in the specified repository. Regular expression matching: Match the image tags to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.

Parameter	Description
Synchronization type	Select External migration to migrate external repositories to Volcano Engine CR Standard Edition instances.

Parameter	Description
Name	The custom name of the registry replication rule. The name must be unique within the same account.

Parameter	Description
API call address	The API service access address starting with http(s)://. For example, https://cr.cn-beijing.aliyuncs.com.
Instance ID	The ID of the Alibaba Cloud ACR instance to be synchronized.
Access Key ID	The account for accessing Alibaba Cloud OpenAPI.
Secret Access Key	The key corresponding to the account for accessing Alibaba Cloud OpenAPI.
Repository type	Synchronization is only supported for artifacts in image repositories, not for those in Chart repositories.
Namespace	The name of the namespace to be synchronized from Alibaba Cloud ACR. Click Enter to confirm the namespace.
Repository	The OCI artifact repository in the namespace of the external source repository to be synchronized. All: Synchronize all OCI artifact repositories in the specified namespace. Regular expression matching: Match the OCI artifact repositories to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.
Tag	The OCI artifact tags to be synchronized. All: Synchronize all OCI artifact tags in the specified repository. Regular expression matching: Match the OCI artifact tags to be synchronized by entering a regular expression rule. For configuration details, see Regular expression matching examples.