diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go
index 83b4b09078..6117cc6031 100644
--- a/pkg/compute/models/cloudregions.go
+++ b/pkg/compute/models/cloudregions.go
@@ -1262,10 +1262,14 @@ func (self *SCloudregion) GetStoragecaches() ([]SStoragecache, error) {
 }
 
 func (self *SCloudregion) newCloudimage(ctx context.Context, userCred mcclient.TokenCredential, iImage SCachedimage) error {
-	_, err := db.FetchByExternalId(CachedimageManager, iImage.GetGlobalId())
+	externalId := iImage.GetGlobalId()
+	lockman.LockRawObject(ctx, CachedimageManager.Keyword(), externalId)
+	defer lockman.ReleaseRawObject(ctx, CachedimageManager.Keyword(), externalId)
+
+	_, err := db.FetchByExternalId(CachedimageManager, externalId)
 	if err != nil {
 		if errors.Cause(err) != sql.ErrNoRows {
-			return errors.Wrapf(err, "db.FetchModelObjects(%s)", iImage.GetGlobalId())
+			return errors.Wrapf(err, "db.FetchModelObjects(%s)", externalId)
 		}
 		image := &iImage
 		image.SetModelManager(CachedimageManager, image)
@@ -1274,7 +1278,7 @@ func (self *SCloudregion) newCloudimage(ctx context.Context, userCred mcclient.T
 			return err
 		}
 
-		skuUrl := self.getMetaUrl(meta.ImageBase, iImage.GetGlobalId())
+		skuUrl := self.getMetaUrl(meta.ImageBase, externalId)
 		err = meta.Get(skuUrl, image)
 		if err != nil {
 			return errors.Wrapf(err, "Get")
@@ -1291,7 +1295,7 @@ func (self *SCloudregion) newCloudimage(ctx context.Context, userCred mcclient.T
 	cloudimage.SetModelManager(CloudimageManager, cloudimage)
 	cloudimage.Name = iImage.Name
 	cloudimage.CloudregionId = self.Id
-	cloudimage.ExternalId = iImage.GetGlobalId()
+	cloudimage.ExternalId = externalId
 	err = CloudimageManager.TableSpec().Insert(ctx, cloudimage)
 	if err != nil {
 		return errors.Wrapf(err, "Insert cloudimage")