Single service comparison

Azure ACR offers a single cross-region registry abstraction: a Premium registry geo-replicates content to paired regions and exposes one login server for clients, with availability-zone redundancy. Huawei SWR is a region-scoped managed registry bound to one region; there is no native equivalent to ACR geo-replication or one multi-region endpoint. Architects must model image distribution as multiple regional SWR registries and add their own sync, caching, or pull-through logic.

Identity and data-plane models diverge. ACR authenticates with Azure Active Directory identities, managed identities, and admin tokens, exposing Azure Resource Manager APIs for replication, tasks, and webhooks. SWR authenticates through Huawei IAM users, groups, and agency roles applied to organizations and namespaces, and exposes the Docker Registry HTTP v2 API plus SWR REST APIs. Both speak the Docker CLI, but RBAC granularity, token lifetimes, and Kubernetes pull-secret integration differ and must be remapped.

Integrations and operational responsibility differ. ACR couples to AKS managed-identity pull, ACI, ACR Tasks, and Defender scanning; customers run images while Azure operates the registry control plane and storage. SWR couples to CCE and CCI image pull, CodeArts for build pipelines, and optional image scanning. Customers retain responsibility for organization/namespace design, lifecycle policies, and cross-region distribution; Huawei does not provide an ACR-style managed replication plane or scheduled task runner of the same shape.

Assess ACR tier and used features first. SWR maps to ACR for image storage and distribution, but Premium geo-replication has no direct SWR equivalent: plan one SWR registry per target region (often alongside CCE) and decide whether to synchronize via skopeo or crane or accept regional single-write. For each ACR scope, define Huawei organizations and namespaces, and map Azure AD reader/contributor roles onto IAM users, groups, and agency permissions, accounting for the different token model.

Migrate images without re-derivation where possible. Use docker pull then docker push, or tools such as skopeo and crane, to copy preserved digests and tags from ACR into SWR repositories, validating manifest lists, OCI artifacts, and signatures. SWR supports OCI artifacts and Docker Registry v2 pulls, so direct copy works for most images, but re-sign images with the target trust model and re-run scans, since Azure content trust and Defender baselines do not transfer.

Repoint compute workloads to SWR. Update Kubernetes manifests and Helm charts to reference swr.<region>.myhuaweicloud.com endpoints, and create imagePullSecrets from SWR long-lived credentials or IAM token-based auth as CCE supports. Replace ACR Tasks and webhook build triggers with Huawei CodeArts Repo or Build pipelines, or your existing CI. Adjust AKS-specific managed-identity pull assumptions to explicit registry credentials, and validate retag and rollback behavior against the new endpoint.

Validate per region before cutover. Test pull latency, concurrency, and failover from each CCE cluster, then cut over a non-production workload first. Reassess cost: ACR bills by tier plus storage and inter-region replication egress, while SWR bills registry usage, storage, and traffic, with cross-region sync incurring separate transfer charges. Document residual gaps such as no native ACR-style geo-replication, scheduled tasks, and content-trust parity, and plan operational scripts until Huawei adds equivalents.