Alibaba Function Compute migration, from Terraform to containers

The tutorial in five moves

1. 01

   1. List the functions and their triggers

   Each function in Terraform is one unit. Triggers, such as an HTTP, timer or OSS event trigger, are not in the demo estate, so collect them from the Alibaba Cloud console or your own Terraform. The run says they are replaced and does not model them for you.

2. 02

   2. Run the assessment

   Run the command below in the folder with the Terraform. The run found four resources and four units.

3. 03

   3. Read the class and the reason

   Both functions are CONTAINERIZE with confidence MEDIUM. The reason is the same for the two resource types, fcv3 and the older fc function, so they follow one path.

4. 04

   4. Package each function as a container

   Write an image that runs an HTTP server and your handler. Alibaba Cloud documents the same shape for its own custom containers, which helps: the code that already listens on a port moves with little change.

5. 05

   5. Choose the runtime on STACKIT

   SKE if you run Kubernetes already, a Cloud Foundry Docker app if your teams deploy that way. The run names both and leaves the choice to your platform architects. The STACKIT Cloud Foundry page on containers and buildpacks describes buildpack staging and does not say whether a ready-made container image can be pushed; confirm that with STACKIT before you choose Cloud Foundry for the image.

Two functions, a bucket and a log project, assessed

A small Alibaba Cloud estate written for this page and assessed by StackToIT on 4 November 2026. Left: the two function blocks of the input. Right: the result the run recorded, an excerpt of assessment.json with the values as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "alicloud_fcv3_function" "thumbnail" {
  function_name = "thumbnail"
  runtime       = "python3.12"
  handler       = "index.handler"
  memory_size   = 512
  timeout       = 60
  environment_variables = {
    TARGET_BUCKET = "shop-uploads-eu"
  }
}

resource "alicloud_fc_function" "legacy_notify" {
  service     = "shop"
  name        = "notify"
  runtime     = "nodejs18"
  handler     = "index.handler"
  memory_size = 256
  timeout     = 30
}

[
  {
    "id": "alicloud_fcv3_function.thumbnail",
    "result": {
      "class": "CONTAINERIZE",
      "confidence": "MEDIUM",
      "target": {
        "service": "SKE workload (or Cloud Foundry Docker app)"
      },
      "reason": "STACKIT has no function service. Package the function as a container for SKE or Cloud Foundry, and replace its triggers."
    }
  },
  {
    "id": "alicloud_fc_function.legacy_notify",
    "result": {
      "class": "CONTAINERIZE",
      "confidence": "MEDIUM",
      "target": {
        "service": "SKE workload (or Cloud Foundry Docker app)"
      },
      "reason": "STACKIT has no function service. Package the function as a container for SKE or Cloud Foundry, and replace its triggers."
    }
  },
  {
    "id": "alicloud_log_project.functions",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Logs"
      }
    }
  },
  {
    "id": "alicloud_oss_bucket.uploads",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Object Storage"
      },
      "reason": "An OSS bucket becomes a STACKIT Object Storage bucket with an S3 API. Applications that use the OSS SDK change their client; lifecycle, replication and access settings need review."
    }
  }
]

• One path for two resource types

  alicloud_fcv3_function and alicloud_fc_function receive the same class, target and reason.

• The runtime becomes a base-image choice

  python3.12 and nodejs18 are runtime names of Function Compute. On STACKIT they turn into the base image you pick for the container. In the same way, memory_size (512 and 256) becomes a memory limit you set on the container, and timeout (60 and 30 seconds) a request timeout you set on the ingress or load balancer; that translation is yours, the run does not carry these values.

• Neighbours move differently

  The bucket is RECONFIGURE to STACKIT Object Storage with an S3 API, and the log project is RECONFIGURE to STACKIT Logs. Applications that use the OSS SDK change their client.

Command and output files

The run was made from inside the input folder; the output folder sits next to it, hence ../out. --offline prevents network requests; --no-validate skips the OpenTofu validation of the source, so the demo input itself was not validated by OpenTofu.

# run from inside the demo's input folder; the output folder sits next to it
stacktoit assess . ../out --offline --no-validate

# files to open next
../out/assessment.json
../out/migration/data-movement.md
../out/execution/manual/actions.md

## Wave 1 — 4 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_fc_function.legacy_notify` | CONTAINERIZE / MEDIUM | SKE workload (or Cloud Foundry Docker app) |
| `alicloud_fcv3_function.thumbnail` | CONTAINERIZE / MEDIUM | SKE workload (or Cloud Foundry Docker app) |
| `alicloud_log_project.functions` | RECONFIGURE / MEDIUM | STACKIT Logs |
| `alicloud_oss_bucket.uploads` | RECONFIGURE / MEDIUM | STACKIT Object Storage |

• All four in one wave

  The function names the bucket only as a string, TARGET_BUCKET = "shop-uploads-eu". A string is not a reference, so the run sees no dependency and puts all four units in wave 1. If the order matters to you, for example the bucket first, you set it yourself in the migration plan.

• The bucket is stateful

  migration/data-movement.md lists the bucket with the mechanism UNKNOWN and the state DECISION_REQUIRED. The functions are not listed there, because a function holds no data of its own.

How the Function Compute estate maps

Classes as the run decided them. The reason on both functions is: STACKIT has no function service, so you package the function as a container and replace its triggers.

What to rebuild before anything runs

Facts about Function Compute, SKE and STACKIT Logs come from the pages listed under sources, read on the day this page was written.

• An HTTP server in the image

  A Function Compute custom container must contain an HTTP server that listens on 0.0.0.0 at the configured port, 9000 by default, and starts within 120 seconds. If your functions use the built-in runtimes with a handler like index.handler, you write that server, or use a framework that exposes the handler over HTTP.

• Triggers

  Replace each trigger. An HTTP trigger becomes a Kubernetes Service and an ingress or an Application Load Balancer rule, which the STACKIT ALB supports with routing by host, path, header or query. Timer and event triggers become scheduled jobs or consumers that you write. This is general practice, not output of the run.

• State and files

  The Function Compute writable layer is lost when the container is destroyed, and Alibaba Cloud advises NAS or OSS for persistent data. On STACKIT use a volume or Object Storage in the same way.

• Logs

  Standard output of a custom container goes to the Simple Log Service project you configure. On SKE you collect it with a log agent into STACKIT Logs or your existing stack; the STACKIT Logs page names Grafana Alloy, Fluentd, Fluent Bit and the OpenTelemetry Collector.

• Scale and cost model

  General practice: a Deployment on SKE has a replica count and runs on a node pool, so concurrency, start-up behaviour and idle cost are now yours to set. Decide the minimum replicas per function and measure under load.

Questions platform teams ask

Sources

• Alibaba Cloud docs: Function Compute custom container images
• STACKIT docs: Kubernetes Engine (SKE) basics
• STACKIT docs: Application Load Balancer features
• STACKIT docs: Logs introduction
• STACKIT docs: Cloud Foundry containers and buildpacks