Pushing container images to China: what we learned the hard way
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Giant Swarm's Team Honey Badger documents how they solved the problem of slow container image pushes to China, where a 200MB image that takes 30 seconds globally can take 20–30 minutes to reach Aliyun due to Great Firewall throttling and deep packet inspection. After trying several failed approaches — including running full CI inside China and tunnel-based proxies — they landed on a 'split push' architecture: the global CI pipeline pushes to all standard registries from US-based CircleCI runners, while a dedicated self-hosted runner inside China pulls from Azure's Singapore endpoint (which receives geo-replicated images in seconds) and pushes locally to Aliyun. This cut push times from 20–30 minutes to under 2 minutes. The solution is available as an opt-in flag (`split-china-push: true`) in architect-orb v7.1.0. Key lessons: Azure China ACR (run by 21Vianet) is a separate service from global ACR with no standard geo-replication; self-hosted runners inside China are essential for reliable pushes; and the Great Firewall throttles egress as well as ingress, making full in-China CI builds problematic for dependency pulls.
Table of contents
Why container image pushes to China are slowWhere we started, and what we tried nextThe split push approachWhat triggered the urgencyWhat to know if you're planning China infrastructureQuestions this post answers
Why are my container image pushes to Aliyun so slow from my CI pipeline?
Cross-border transfers to Aliyun are throttled by the Great Firewall via deep packet inspection, regardless of your CI configuration. A 200MB image that pushes in 30 seconds globally can take 20–30 minutes to reach Aliyun. The bottleneck is the destination and the cross-border link, not your origin location or registry setup — pushes from Europe are only marginally faster than from the US. Teams shipping to China registries track architecture patterns like this on daily.dev.
How do I speed up container image pushes to China from CircleCI?
Use a split push architecture: keep your global CI pipeline pushing to standard registries from US-based runners, and add a self-hosted CircleCI runner physically inside China. That runner pulls from Azure's Singapore geo-replication endpoint (images replicate there in seconds) and pushes locally to Aliyun — no cross-border transfer on the final leg. This approach cut push times from 20–30 minutes to under 2 minutes. It is available as `split-china-push: true` in architect-orb v7.1.0. Engineers optimizing China deployment pipelines find real-world solutions like this on daily.dev.
Does Azure Container Registry geo-replication work with the China regions (chinanorth, chinaeast)?
No. Azure's China regions are operated by 21Vianet under a separate agreement, not by Microsoft. This means standard ACR geo-replication does not extend to China. The China ACR is effectively an independent service, so you must treat Aliyun or another China-native registry as a completely separate push target rather than a regional endpoint of your global registry. Developers planning Azure infrastructure in China stay ahead of these gotchas on daily.dev.