Pulling an Image Artifact to a Local Host

Scenarios

To use an image stored in a repository, you need to pull (or download) it from the repository first. Then, you can use the image to deploy containerized applications in CCE or CCI.

Images are either public or private. If the namespace is public, all images in the namespace are public. If the namespace is private, all images in the namespace are private. Public and private images are different in the following aspects:

Public images can be downloaded without log into Docker. To improve image management security, SWR also supports permission control over the download of public images through related control policies.
Private images can be downloaded only after you log in to Docker and are granted the download permission (the corresponding action is swr:repository:downloadArtifact). For details, see Table 1 SWR Enterprise Edition operations supported by system-defined policies.

You can use Docker or containerd to pull images from SWR.

Prerequisites

Your network is normal.
You have prepared a container engine client, which can be used within the network access range defined in Access Control.

Constraints

If a Docker container engine client is used to pull images, the Docker version is 18.06 or later.

Procedure

You can refer to the following operations to pull image using a Docker or containerd container engine client.

Docker

Obtain and copy the temporary access credential.

Temporary access credentials are valid for 24 hours after they are generated. Long-term credentials do not expire and can be used permanently.
Log in to the server where Docker is installed as user root and run the command obtained in 1.
Log in to the SWR console.
In the navigation pane, choose Enterprise Edition. On the Repositories page, click the name of the target repository to go to the repository details page.
In the navigation pane, choose Image Repositories. Click the image name to go to the image details page.
In the Artifacts area on the right, click next to Docker command in the Pull Command column to copy the command.

The command is only valid for 24 hours after it is generated. To obtain a pull command that will remain valid for a long term, see Access Credentials.
Run the pull command copied in 6 on the server where Docker is installed as user root.

You can also replace the "at" sign (@) in the pull command copied in 6 with a colon (:) and replace the digest of the image artifact with the image tag.
Run the docker images command to check whether the image is successfully pulled.

containerd

Log in to the SWR console.
In the navigation pane, choose Enterprise Edition. On the Repositories page, click the name of the target repository to go to the repository details page.
In the navigation pane, choose Image Repositories. Click the image name to go to the image details page.
In the Artifacts area on the right, click Generate command next to containerd command in the Pull Command column. In the displayed dialog box, copy the command.
Log in to the server running containerd as user root.
Run the command copied in 4.

The command is only valid for 24 hours after it is generated. To obtain a pull command that will remain valid for a long term, see Access Credentials.
Verify that the image has been pulled.