Containers on AWS
How containers, images, and registries fit together on AWS.
A container bundles your application with everything it needs to run. A container image is the read-only template; a running copy of that image is a container.
The building blocks
- Docker image — built from a
Dockerfile. - Amazon ECR — a private registry that stores your images.
- ECS — pulls the image and runs it as one or more tasks.
The flow is always the same: build an image, push it to a registry, then run it. ECS is the layer that runs it at scale.
Example
# Build an image locally, then it is ready to push to ECR
docker build -t my-app:1.0 .
docker images my-appWhen to use it
- A DevOps team stores all application Docker images in Amazon ECR so ECS can pull them without public-internet credentials.
- A CI pipeline builds a new image, tags it with the git SHA, and pushes to ECR so every ECS deployment is traceable.
- A security team enables ECR image scanning so vulnerabilities are caught before any new image reaches an ECS task.
More examples
Authenticate Docker to ECR
Obtains a temporary ECR password and feeds it to Docker so subsequent push/pull commands are authenticated.
aws ecr get-login-password --region us-east-1 \
| docker login \
--username AWS \
--password-stdin \
123456789012.dkr.ecr.us-east-1.amazonaws.comBuild and Push Image to ECR
Builds a Docker image tagged with the current git commit SHA and pushes it to the ECR repository.
REPO=123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app
GIT_SHA=$(git rev-parse --short HEAD)
docker build -t "$REPO:$GIT_SHA" .
docker push "$REPO:$GIT_SHA"Enable Automatic Image Scanning
Turns on automatic vulnerability scanning every time a new image is pushed to the ECR repository.
aws ecr put-image-scanning-configuration \
--repository-name my-app \
--image-scanning-configuration scanOnPush=true
Discussion