Pushing to ECR

Amazon ECR is a private Docker registry — push your images there so AWS services can pull them.

Amazon Elastic Container Registry (ECR) is a private, secure Docker registry inside AWS. You build an image, tag it with your ECR repository URL, and push it. ECS, EKS, and Lambda then pull from ECR to run your app.

The push flow

  1. Create a repository (once).
  2. Authenticate Docker to ECR.
  3. Tag your local image with the ECR URL.
  4. Push.

Tag images with a unique version — often the Git commit SHA — so every deploy references an exact, immutable image.

Example

Example · bash
ACCOUNT=123456789012
REGION=us-east-1
REPO=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/myapp

# 1. Create the repo (first time only)
aws ecr create-repository --repository-name myapp

# 2. Log Docker in to ECR
aws ecr get-login-password --region $REGION | \
  docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com

# 3. Tag and push using the git SHA as the version
docker build -t $REPO:$(git rev-parse --short HEAD) .
docker push $REPO:$(git rev-parse --short HEAD)

When to use it

  • A team pushes their Docker image to ECR so ECS Fargate can pull it privately without exposing the image on Docker Hub.
  • A CI pipeline pushes a new image to ECR tagged with the commit SHA after every successful build so each deploy is traceable.
  • An operations team uses ECR image scanning to detect vulnerabilities in the base image before the image is deployed to production.

More examples

Create an ECR repository

Creates a private ECR repository with automatic vulnerability scanning enabled on every pushed image.

Example · bash
aws ecr create-repository \
  --repository-name myapp \
  --image-scanning-configuration scanOnPush=true \
  --region us-east-1

Authenticate Docker to ECR and push

Authenticates Docker with ECR using short-lived credentials, then tags and pushes the image to the private registry.

Example · bash
ACCOUNT=123456789012
REGION=us-east-1
REPO=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/myapp

# Login
aws ecr get-login-password --region $REGION \
  | docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com

# Tag and push
docker tag myapp:latest $REPO:${GIT_SHA}
docker push $REPO:${GIT_SHA}

List images in ECR repository

Lists all image tags and digests in the repository so you can confirm the push succeeded and see available versions.

Example · bash
aws ecr list-images \
  --repository-name myapp \
  --query 'imageIds[*].[imageTag,imageDigest]' \
  --output table

Related

deploy build imagedeploy ecs fargate

Discussion

  • Be the first to comment on this lesson.
Pushing to ECR — AWS Deployment | SoundsCode