Using ECR Images
Amazon ECR is AWS's private container registry; nodes pull images from it automatically.
Amazon ECR (Elastic Container Registry) is where most EKS teams store their container images. It integrates with IAM, so worker nodes can pull images without you managing registry passwords.
How authentication works
The node IAM role includes AmazonEC2ContainerRegistryReadOnly, letting the kubelet pull private images from ECR in the same account with no imagePullSecret needed.
Push then reference
- Build your image and tag it with the ECR repository URI.
- Authenticate Docker to ECR and push.
- Reference the full ECR image URI in your Deployment.
Example
# Log in, build, tag, and push an image to ECR
aws ecr get-login-password --region us-east-1 \
| docker login --username AWS \
--password-stdin 111122223333.dkr.ecr.us-east-1.amazonaws.com
docker build -t web:1.0 .
docker tag web:1.0 111122223333.dkr.ecr.us-east-1.amazonaws.com/web:1.0
docker push 111122223333.dkr.ecr.us-east-1.amazonaws.com/web:1.0When to use it
- A DevOps team pushes a newly built Docker image to ECR in CI and references the ECR URI in the Deployment so EKS nodes pull it without public internet access.
- A security team configures ECR lifecycle policies to automatically delete untagged images older than 30 days, keeping storage costs under control.
- A platform team enables ECR image scanning on push to detect known CVEs in base images before they are deployed to the EKS cluster.
More examples
Login and push image to ECR
Authenticates to ECR with a temporary token, builds a local image, tags it with the ECR repository URI, and pushes it.
ACCOUNT=123456789012
REGION=us-east-1
REPO=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/my-app
aws ecr get-login-password --region $REGION | \
docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com
docker build -t my-app:v1.0 .
docker tag my-app:v1.0 $REPO:v1.0
docker push $REPO:v1.0Use ECR image in a Deployment
A Deployment that references a private ECR image; EKS nodes use their IAM instance profile to pull the image automatically.
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
replicas: 2
selector:
matchLabels:
app: my-app
template:
metadata:
labels:
app: my-app
spec:
containers:
- name: app
image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0
imagePullPolicy: AlwaysSet ECR lifecycle policy
Sets a lifecycle policy that automatically removes untagged images from the ECR repository after 30 days, reducing storage costs.
aws ecr put-lifecycle-policy \
--repository-name my-app \
--lifecycle-policy-text '{
"rules": [{
"rulePriority": 1,
"description": "Expire untagged images after 30 days",
"selection": {"tagStatus": "untagged", "countType": "sinceImagePushed", "countUnit": "days", "countNumber": 30},
"action": {"type": "expire"}
}]
}'
Discussion