ECR for container image registry in AWS - Step-by-Step Execution

Process Flow - ECR for container image registry

Create ECR Repository

↓

Build Container Image

↓

Tag Image with Repo URI

↓

Authenticate Docker to ECR

↓

Push Image to ECR Repository

↓

Image Stored in ECR

↓

Use Image in ECS or other services

This flow shows how you create an ECR repository, build and tag a container image, authenticate Docker, push the image to ECR, and then use it in AWS services.

Execution Sample

AWS

aws ecr create-repository --repository-name my-app
docker build -t my-app .
docker tag my-app:latest 123456789012.dkr.ecr.region.amazonaws.com/my-app:latest
aws ecr get-login-password --region region | docker login --username AWS --password-stdin 123456789012.dkr.ecr.region.amazonaws.com
docker push 123456789012.dkr.ecr.region.amazonaws.com/my-app:latest

This sequence creates an ECR repo, builds and tags a container image, logs in to ECR, and pushes the image.

Process Table

Step	Action	Input/Command	Result/Output
1	Create ECR repository	aws ecr create-repository --repository-name my-app	Repository 'my-app' created with URI 123456789012.dkr.ecr.region.amazonaws.com/my-app
2	Build container image	docker build -t my-app .	Image 'my-app:latest' built locally
3	Tag image with repo URI	docker tag my-app:latest 123456789012.dkr.ecr.region.amazonaws.com/my-app:latest	Image tagged for ECR push
4	Authenticate Docker to ECR	aws ecr get-login-password --region region | docker login --username AWS --password-stdin 123456789012.dkr.ecr.region.amazonaws.com	Docker authenticated to ECR registry
5	Push image to ECR	docker push 123456789012.dkr.ecr.region.amazonaws.com/my-app:latest	Image pushed and stored in ECR repository
6	Use image in AWS services	Reference image URI in ECS task definition	Container image ready for deployment
7	Exit	All steps completed successfully	Image stored and ready for use

💡 All steps completed successfully; image is stored in ECR and ready for deployment.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
Repository URI	None	123456789012.dkr.ecr.region.amazonaws.com/my-app	Same	Same	Same	Same	Same
Local Image	None	None	my-app:latest	Tagged as my-app:latest and repo URI	Same	Same	Same
Docker Authenticated	False	False	False	False	True	True	True
Image in ECR	False	False	False	False	False	True	True

Key Moments - 3 Insights

Why do we need to tag the image with the repository URI before pushing?

Tagging the image with the repository URI tells Docker where to push the image. Without this, Docker won't know the destination registry. See execution_table step 3.

What happens if Docker is not authenticated to ECR before pushing?

The push will fail because ECR requires authentication. Step 4 shows the authentication step before pushing in step 5.

Is the image immediately available for use after pushing?

Yes, once the push completes successfully (step 5), the image is stored in ECR and ready to be used by AWS services (step 6).

Visual Quiz - 3 Questions

Look at the execution table, what is the repository URI after step 1?

A docker.io/my-app

B 123456789012.dkr.ecr.region.amazonaws.com/my-app

C my-app:latest

D None

💡 Hint

Check the 'Result/Output' column in row for step 1.

At which step does Docker authenticate to ECR?

A Step 4

B Step 3

C Step 5

D Step 2

💡 Hint

Look for the action 'Authenticate Docker to ECR' in the execution table.

If the image was not tagged with the repository URI, what would change in the execution table?

A Step 5 would succeed anyway

B Step 1 would fail

C Step 3 would be missing or fail

D Step 4 would fail

💡 Hint

Tagging happens in step 3; without it, Docker cannot push to ECR.

Concept Snapshot

ECR (Elastic Container Registry) stores container images.
Create a repository with AWS CLI.
Build and tag your image with the repo URI.
Authenticate Docker to ECR before pushing.
Push image to ECR to store it.
Use stored images in AWS services like ECS.

Full Transcript

This visual execution shows how to use AWS Elastic Container Registry (ECR) to store container images. First, you create an ECR repository which gives you a URI. Then you build your container image locally and tag it with this URI so Docker knows where to push it. Next, you authenticate Docker to the ECR registry using AWS credentials. After authentication, you push the tagged image to the ECR repository. Once pushed, the image is stored securely and ready to be used by AWS services such as ECS for deploying containers. Each step is essential: tagging tells Docker the destination, authentication allows secure access, and pushing uploads the image. This flow ensures your container images are safely stored and easily accessible for deployment.

Practice

1. What is the primary purpose of AWS Elastic Container Registry (ECR)?

easy

A. To store and manage container images securely

B. To run containerized applications

C. To monitor AWS cloud resources

D. To provide virtual machines for deployment

Solution

1. Step 1: Understand ECR's role

   AWS ECR is designed to store container images safely and manage them.

2. Step 2: Differentiate from other services

   Running containers is done by ECS or EKS, not ECR. Monitoring and VMs are unrelated.

3. Final Answer:

   To store and manage container images securely -> Option A

4. Quick Check:

   ECR = Container image storage [OK]

Hint: ECR stores images, ECS/EKS run containers [OK]

Common Mistakes:

• Confusing ECR with ECS or EKS
• Thinking ECR runs containers
• Assuming ECR monitors resources

2. Which AWS CLI command correctly creates a new ECR repository named my-app?

easy

A. aws ecr make-repo --repository my-app

B. aws ecr new-repository --name my-app

C. aws ecr create-repository --repository-name my-app

D. aws ecr init-repository --repo my-app

Solution

1. Step 1: Recall AWS CLI syntax for ECR

   The correct command to create a repository is aws ecr create-repository --repository-name <name>.

2. Step 2: Check options for correctness

   Options B, C, and D use invalid commands or flags not recognized by AWS CLI.

3. Final Answer:

   aws ecr create-repository --repository-name my-app -> Option C

4. Quick Check:

   Create repo command = aws ecr create-repository --repository-name my-app [OK]

Hint: Use 'create-repository' with '--repository-name' flag [OK]

Common Mistakes:

• Using incorrect command verbs like 'new' or 'make'
• Wrong flag names like '--name' or '--repo'
• Assuming 'init-repository' is valid

3. Given this AWS CLI command output snippet after pushing an image to ECR, what does the imageScanStatus value IN_PROGRESS indicate?

{
  "imageId": {"imageTag": "v1"},
  "imageScanStatus": {"status": "IN_PROGRESS"}
}

medium

A. The image scan for vulnerabilities is currently running

B. The image scan has completed with no issues

C. The image push failed due to scan errors

D. The image is not scanned because scanning is disabled

Solution

1. Step 1: Understand imageScanStatus meaning

   The status IN_PROGRESS means the scan is currently running on the image.

2. Step 2: Eliminate other options

   Completed scans show COMPLETE, failures show FAILED, and disabled scanning shows no status.

3. Final Answer:

   The image scan for vulnerabilities is currently running -> Option A

4. Quick Check:

   IN_PROGRESS = scan running [OK]

Hint: IN_PROGRESS means scan is running, not done [OK]

Common Mistakes:

• Assuming IN_PROGRESS means scan passed
• Confusing scan failure with in-progress status
• Thinking scanning is disabled

4. You tried to push a container image to ECR but got an error: denied: Your authorization token has expired. What is the most likely fix?

medium

A. Restart the AWS CLI tool

B. Delete the repository and create a new one

C. Change the image tag and push again

D. Run aws ecr get-login-password again to refresh credentials

Solution

1. Step 1: Identify cause of authorization token error

   ECR login tokens expire after 12 hours, so pushing images requires fresh tokens.

2. Step 2: Refresh credentials properly

   Running aws ecr get-login-password and logging in again refreshes the token.

3. Final Answer:

   Run aws ecr get-login-password again to refresh credentials -> Option D

4. Quick Check:

   Expired token fix = refresh login [OK]

Hint: Refresh ECR login token before pushing images [OK]

Common Mistakes:

• Deleting repository unnecessarily
• Changing image tag won't fix auth
• Restarting CLI doesn't refresh token

5. You want to ensure that only images with specific tags can be overwritten in your ECR repository. Which ECR feature helps enforce this?

hard

A. VPC endpoints

B. Image tag immutability

C. Lifecycle policies

D. Cross-region replication

Solution

1. Step 1: Understand tag immutability

   Image tag immutability prevents overwriting images with the same tag, protecting specific versions.

2. Step 2: Differentiate from other features

   Lifecycle policies manage image cleanup, VPC endpoints control network access, replication copies images across regions.

3. Final Answer:

   Image tag immutability -> Option B

4. Quick Check:

   Prevent tag overwrite = immutability [OK]

Hint: Use tag immutability to block overwrites [OK]

Common Mistakes:

• Confusing lifecycle policies with immutability
• Thinking VPC endpoints control tags
• Assuming replication affects tag overwrite