Help Center/ FunctionGraph/ User Guide/ Creating a Function/ Creating a Function with an Image
Updated on 2025-08-19 GMT+08:00
View PDF
Share

Creating a Function with an Image

FunctionGraph supports loading and running functions in container images. Compared with directly uploading code, you can use custom code packages, which is flexible and reduces migration costs.

Public and private images are supported. For details, see Setting Image Attributes.

Notes and Constraints

Table 1 Notes and Constraints

Item

Description

Custom container image port
  • The custom container image must contain an HTTP server with listening port 8000.
  • The port of a custom container image must be 8000.

Container image-based function
  • When creating an event function, create an HTTP server to implement a handler (method: POST, path: /invoke) and an initializer (method: POST, path: /init).
  • The function must return a valid HTTP response that complies with the following structure. 
    {
    "isBase64Encoded": true|false,
    "statusCode": httpStatusCode,
    "headers": {"headerName":"headerValue",...},
    "body": "..."
}
  • Command, Args, and Working dir can contain up to 5120 characters.
  • When a function is executed at the first time, the image is pulled from SWR, and the container is started during cold start of the function, which takes a certain period of time. If there is no image on a node during subsequent cold starts, an image will be pulled from SWR.
  • The image package cannot exceed 10 GB. For a larger package, reduce the capacity. For example, mount the data of a question library to a container where the data was previously loaded through an external file system.
  • When an out of memory (OOM) error occurs, view the memory usage in the function execution result.

Prerequisites

  • To perform the operations described in this section, ensure that you have the FunctionGraph Administrator permissions, that is, the full permissions for FunctionGraph. For more information, see Permissions Management.
  • You have created an agency with the SWR Admin permission as instructed in Configuring Agency Permissions. Images are stored in SWR, and only users with this permission can invoke and pull images.

Creating a Function

  1. Log in to the FunctionGraph console. In the navigation pane, choose Functions > Function List.
  2. On the Function List page, click Create Function in the upper right corner.
  3. Select Container Image. For details about the configuration information, see Table 2.
    Table 2 Container image configuration

    Parameter

    Description

    Example Value

    Function Type

    Two types are available:

    • Event Function: Requests are usually in JSON format. All trigger types supported by FunctionGraph can be used to trigger event functions.
    • HTTP Function: triggered once HTTP requests are sent to specific URLs.

    Event Function

    Region

    Select a region where you will deploy your code.

    Regions are geographic areas isolated from each other. Resources are region-specific and cannot be used across regions through internal network connections. For low network latency and quick resource access, select the nearest region.

    CN East-Shanghai1

    Function Name

    Name of the function, which must meet the following requirements:

    • Consists of 1 to 60 characters, and can contain letters, digits, hyphens (-), and underscores (_).
    • Starts with a letter and ends with a letter or digit.

    SWR-demo

    Enterprise Project

    Select the enterprise project to which the function belongs. Enterprise projects let you manage cloud resources and users by project.

    The default value is default. You can select the created enterprise project.

    If the Enterprise Management service is not enabled, this parameter is unavailable. For details, see Enabling the Enterprise Project Function.

    default

    Agency

    Select an agency for the function. To access other cloud services through an agency, select an agency with the SWR Admin permission. For details about how to create an agency, see Creating a Function Agency.

    If no default agency is available, FunctionGraph allows you to quickly create a default agency named fgs_default_agency. For details, see Default Agency.

    fgs_default_agency

    Container Image

    Enter an image URL, that is, the location of the container image. You can click View Image to view private and shared images. You can also click Select SWR Image and select a public or private image from the image list. After the image is selected, the image URL is automatically filled in. For details about how to create an image, see Creating an Image.

    Image in SWR, for example, swr.region_id.myhuaweicloud.com/my_group/my_image:latest.

    swr.region_id.myhuaweicloud.com/my_group/my_image:latest

    Listening Port

    Currently, this parameter is available only in the ME-Riyadh region.

    Port listened by the HTTP server in the code, which must be the same as the EXPOSE port configured in the image. The port number ranges from 1025 to 65535. Default: 8000.

    8000

    Container Image Override

    Optional.

    If this parameter is set, the image configuration in the dockerfile file will be overwritten. If this parameter is not set, the default image configuration is used.

    • CMD: container startup command. Example: /bin/sh. If no command is specified, the entrypoint or CMD in the image configuration will be used. Enter one or more commands separated with commas (,).
    • Args: container startup parameter. Example: -args,value1. If no argument is specified, CMD in the image configuration will be used. Enter one or more arguments separated with commas (,).
    • Working Dir: working directory where a container runs. If no directory is specified, the directory in the image configuration will be used. The directory must start with a slash (/).
    • User ID: user ID for running the image. If no user ID is specified, the default value 1003 will be used.
    • Group ID: user group ID. If no user group ID is specified, the default value 1003 will be used.

    -

    Set parameters of advanced settings by referring to Table 3.

    Figure 1 Advanced setting parameters

    Table 3 Advanced setting parameters

    Parameter

    Description

    Example Value

    Public Access

    If this feature is enabled, functions can access services on the public network through the default NIC. The public network access bandwidth is shared among users and applies only to test scenarios.

    Enabled

    VPC Access

    To enable this feature, you need to configure an agency with VPC management permissions. If you select Use no agency in the Basic Information area, this feature cannot be enabled.

    If this feature is enabled, functions will use the NIC bound to the configured VPC for network access, and the default NIC of FunctionGraph will be disabled. That is, the Public Access parameter does not take effect.

    After this feature is enabled, you can select the VPC and subnet that the function needs to access.

    Disabled

    Collect Logs

    After it is enabled, logs generated during function execution will be reported to LTS. LTS will be billed on a pay-per-use basis. For details, see LTS Pricing Details.

    Configure the following parameters:

    • Log Configuration
      • Auto: Use the default log group and log stream.
      • Custom: Select the log group and log stream you created.
    • Log Tag

      You can filter function logs on the LTS console by tag. For details, see Log Management.

      A tag key or value can contain a maximum of 64 characters, including only digits, letters, underscores (_), and hyphens (-). A maximum of 10 tags can be added.

    Disabled

    Static Encryption with KMS

    This parameter can be configured only in the LA-Sao Paulo1 region.

    Determine whether to use KMS-based static encryption for function code.

    CAUTION:

    DEW is billed by the pay-per-use mode. For details, see DEW Billing.

    You can select the following encryption types:

    • functiongraph/default (default): The function automatically creates a default key in DEW under your account.

      If you use the default key for encryption and decryption for the first time, ensure that the function agency has the following permissions: kms:dek:decrypt, kms:dek:create, kms:cmk:create, kms:cmk:get, and kms:cmk:list.

    • Customer master key (CMK): You can select a created key to encrypt the function code. For details about how to create a customer master key, see Creating a Custom Key. To use customer master key, ensure that the function agency has the following permissions: kms:dek:decrypt, kms:dek:create, kms:cmk:get and kms:cmk:list.
      CAUTION:

      If you select Customer master key (CMK), do not delete the CMK used for function encryption in DEW. Otherwise, the function execution will fail because encrypted data cannot be decrypted.

    Configure the agency permission policy on the IAM console by referring to Creating a Custom Policy in JSON View.

    functiongraph/default (default)
  4. Click Create Function. The function details page is displayed. For details about other configurations, see Configuring Functions.

Updating the Function Image

On the Code tab page of the image-based function, click Deploy Image. In the displayed dialog box, enter the new image URL and click OK. To obtain the URL, perform the following operations:
  1. Log in to the SWR console. In the navigation pane, choose My Images.
  2. Click the Private Images or Images From Others tab. In the image list, click the image name to go to the details page.
  3. Click the Tags tab, copy the download command in the image tag list, and delete docker pull from the command to obtain the image URL.

Helpful Links

Parent Topic: Creating a Function