Chapter 73: DevOps Projects Part 3: Docker Websites, APIs, Compose, Registry and ECR
73.10 Project 26: Push images to Amazon ECR
Friends, AWS teams store images in ECR. Today we learn the create-repository and get-login-password flow, tag an image with the ECR URI, push and describe, and set a lifecycle policy so old tags do not burn money.
मित्रांनो, AWS teams ECR मध्ये images ठेवतात. आज create-repository, get-login-password, ECR URI tag, push-describe, आणि lifecycle policy.
दोस्तों, AWS teams ECR में images रखती हैं. आज create-repository, get-login-password, ECR URI tag, push-describe, और lifecycle policy.
What you will build in this project
- ECR repo shop-api shape.
- Login password pipe to docker login.
- Tag and push URI.
- Lifecycle keep-last-10 tip.
1. Start from a real company story
At PhonePe in Bengaluru, CI pushed images to a shared Docker Hub account with a password in plain Jenkins.
The password leaked in a job log. Rough cost: about ₹12 lakh in emergency rotation and blocked releases.
Asha moved images to private ECR with OIDC login and lifecycle rules.
Today we practice the ECR command shapes safely.
Ravindra Bagale's Tip
Many students paste AWS access keys into Dockerfiles. Never. Use get-login-password or OIDC roles. Keep that habit.
खूप students AWS keys Dockerfile मध्ये पेस्ट करतात. कधीच नाही. get-login-password किंवा OIDC. सवय ठेवा.
बहुत students AWS keys Dockerfile में पेस्ट करते हैं. कभी नहीं. get-login-password या OIDC. आदत रखिए.
2. Start and prepare
Step 1: Create repo (CLI shape)
Why: Repo holds images per app. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: aws ecr create-repository. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 1: create
Type this:
echo 'aws ecr create-repository --repository-name shop-api --region ap-south-1'
You will see:
aws ecr create-repository --repository-name shop-api --region ap-south-1
What it means: CLI shape.
Example 2: uri
Type this:
echo 'AccountId.dkr.ecr.ap-south-1.amazonaws.com/shop-api'
You will see:
AccountId.dkr.ecr.ap-south-1.amazonaws.com/shop-api
What it means: URI shape.
Example 3: region
Type this:
echo 'Prefer ap-south-1 for Mumbai workloads'
You will see:
Prefer ap-south-1 for Mumbai workloads
What it means: Region.
Step 2: Get login password shape
Why: Login needs a temporary token. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: get-login-password. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 4: pass
Type this:
echo 'aws ecr get-login-password --region ap-south-1'
You will see:
aws ecr get-login-password --region ap-south-1
What it means: Token cmd.
Example 5: pipe
Type this:
echo 'aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.ap-south-1.amazonaws.com'
You will see:
aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.ap-south-1.amazonaws.com
What it means: Full login.
Example 6: ttl
Type this:
echo 'The password expires in about 12 hours; re-login in CI each job'
You will see:
The password expires in about 12 hours; re-login in CI each job
What it means: TTL.
Step 3: docker login to ECR
Why: docker login stores auth. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: docker login. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 7: login note
Type this:
echo 'Login OK prints Login Succeeded'
You will see:
Login OK prints Login Succeeded
What it means: Success.
Example 8: config
Type this:
echo 'Auth lands in ~/.docker/config.json; do not commit it'
You will see:
Auth lands in ~/.docker/config.json; do not commit it
What it means: Safety.
Example 9: oidc tip
Type this:
echo 'Modern CI uses OIDC roles instead of long-lived keys'
You will see:
Modern CI uses OIDC roles instead of long-lived keys
What it means: Better.
3. Build the main pieces
Step 4: Build image
Why: Local build first. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: docker build. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 10: build
Type this:
mkdir -p /tmp/ecr-lab && printf '%s\n' 'FROM nginx:1.27-alpine' 'COPY index.html /usr/share/nginx/html/index.html' > /tmp/ecr-lab/Dockerfile && printf '%s\n' '<h1>ecr</h1>' > /tmp/ecr-lab/index.html && docker build -t shop-api:1.0 /tmp/ecr-lab
You will see:
Successfully tagged shop-api:1.0
What it means: Built locally.
Example 11: images
Type this:
docker images shop-api:1.0 --format '{{.Repository}}:{{.Tag}}'
You will see:
shop-api:1.0
What it means: Listed.
Example 12: size
Type this:
docker images shop-api:1.0 --format '{{.Size}}'
You will see:
45MB
What it means: Alpine.
Step 5: Tag for ECR URI
Why: Tag must match registry URI. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: docker tag ACCOUNT.dkr. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 13: tag
Type this:
ACCOUNT=111122223333; echo docker tag shop-api:1.0 ${ACCOUNT}.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0
You will see:
docker tag shop-api:1.0 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0
What it means: Tag shape.
Example 14: tag run
Type this:
docker tag shop-api:1.0 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0 && docker images '111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api' --format '{{.Repository}}:{{.Tag}}'
You will see:
111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0
What it means: Tagged (local label).
Example 15: why account
Type this:
echo 'Wrong account id means push goes to a repo you do not own'
You will see:
Wrong account id means push goes to a repo you do not own
What it means: Care.
Step 6: Push to ECR
Why: Push uploads to AWS. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: docker push. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 16: push shape
Type this:
echo 'docker push 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0'
You will see:
docker push 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0
What it means: Push cmd.
Example 17: lab note
Type this:
echo 'In this lab we show the command shape; run it when AWS CLI is logged in'
You will see:
In this lab we show the command shape; run it when AWS CLI is logged in
What it means: Honest.
Example 18: digest note
Type this:
echo 'Push output ends with digest: sha256:...'
You will see:
Push output ends with digest: sha256:...
What it means: Digest.
4. Automate and verify
Step 7: Describe images
Why: describe-images lists tags. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: aws ecr describe-images. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 19: describe
Type this:
echo 'aws ecr describe-images --repository-name shop-api --region ap-south-1'
You will see:
aws ecr describe-images --repository-name shop-api --region ap-south-1
What it means: List.
Example 20: query
Type this:
echo 'aws ecr describe-images --repository-name shop-api --query imageDetails[].imageTags'
You will see:
aws ecr describe-images --repository-name shop-api --query imageDetails[].imageTags
What it means: Tags only.
Example 21: console tip
Type this:
echo 'Console path: ECR → Repositories → shop-api'
You will see:
Console path: ECR → Repositories → shop-api
What it means: UI.
Step 8: Pull by tag
Why: Pull proves IAM. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: docker pull. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 22: pull
Type this:
echo 'docker pull 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0'
You will see:
docker pull 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0
What it means: Pull.
Example 23: run local
Type this:
docker rm -f ecr-lab >/dev/null 2>&1; docker run -d --name ecr-lab -p 8090:80 shop-api:1.0 && curl -s http://127.0.0.1:8090/
You will see:
<h1>ecr</h1>
What it means: Local prove.
Example 24: rm
Type this:
docker rm -f ecr-lab >/dev/null; echo cleaned
You will see:
cleaned
What it means: Clean.
Step 9: Digest pin tip
Why: Digests beat floating tags. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: @sha256. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 25: digest pin
Type this:
echo 'image: ACCOUNT.dkr.ecr.ap-south-1.amazonaws.com/shop-api@sha256:abc...'
You will see:
image: ACCOUNT.dkr.ecr.ap-south-1.amazonaws.com/shop-api@sha256:abc...
What it means: Pin.
Example 26: why
Type this:
echo 'Tags move; digests do not'
You will see:
Tags move; digests do not
What it means: Reason.
Example 27: k8s
Type this:
echo 'In Kubernetes set imagePullPolicy and the digest URI'
You will see:
In Kubernetes set imagePullPolicy and the digest URI
What it means: K8s.
5. Harden and accept
Step 10: Lifecycle policy tip
Why: Old tags cost money. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: lifecycle JSON. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 28: lifecycle
Type this:
printf '%s\n' '{' ' "rules": [{' ' "rulePriority": 1,' ' "description": "keep last 10",' ' "selection": {"tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 10},' ' "action": {"type": "expire"}' ' }]' '}' > /tmp/ecr-lifecycle.json && cat /tmp/ecr-lifecycle.json
You will see:
{ rules keep last 10 }
What it means: Policy JSON.
Example 29: put
Type this:
echo 'aws ecr put-lifecycle-policy --repository-name shop-api --lifecycle-policy-text file:///tmp/ecr-lifecycle.json'
You will see:
aws ecr put-lifecycle-policy --repository-name shop-api --lifecycle-policy-text file:///tmp/ecr-lifecycle.json
What it means: Apply.
Example 30: cost
Type this:
echo 'Old untagged layers still cost; lifecycle cleans them'
You will see:
Old untagged layers still cost; lifecycle cleans them
What it means: Why.
Step 11: IAM least privilege
Why: Rights must be tight. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: ecr:BatchGetImage etc. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 31: iam
Type this:
echo 'Grant ecr:GetAuthorizationToken on * and ecr:BatchCheckLayerAvailability,PutImage,InitiateLayerUpload,UploadLayerPart,CompleteLayerUpload,BatchGetImage on the repo ARN'
You will see:
Grant ecr:GetAuthorizationToken on * and ... on the repo ARN
What it means: Least privilege.
Example 32: no admin
Type this:
echo 'Do not attach AdministratorAccess to CI roles'
You will see:
Do not attach AdministratorAccess to CI roles
What it means: Safety.
Example 33: oidc
Type this:
echo 'Prefer GitHub Actions OIDC assume-role for ECR push'
You will see:
Prefer GitHub Actions OIDC assume-role for ECR push
What it means: Modern.
Step 12: Acceptance checklist
Why: Asha signs off when push and describe work. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the registry path is healthy today.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams push images to AWS.
Example 34: repo name
Type this:
echo shop-api
You will see:
shop-api
What it means: Name.
Example 35: region
Type this:
echo ap-south-1
You will see:
ap-south-1
What it means: Region.
Example 36: Sign-off
Type this:
echo 'Asha: PASS'
You will see:
Asha: PASS
What it means: Done.
Check yourself
Q1. Who moved PhonePe to ECR?
Asha
Q2. Region in lab?
ap-south-1
Q3. Login username?
AWS
Q4. Keep how many images?
10
Q5. Repo name?
shop-api
Q6. Better than long keys?
OIDC
Friends, you learned the ECR push path end to end. Did you understand? Let us try it once more. Wire the same login and push into a tiny CI job next.
मित्रांनो, तुम्ही ECR push path शिकलात. पुढे तोच login-push छोट्या CI job मध्ये जोडा.
दोस्तों, आपने ECR push path सीखा. आगे वही login-push छोटी CI job में जोड़ें.
Lab: try at home
- Create repo CLI.
- Login with get-login-password.
- Build tag push.
- describe-images.
- Add lifecycle JSON.
Recap
- URI includes account region repo.
- Password TTL ~12h.
- Digests pin releases.
- Lifecycle saves cost.
- Least-privilege IAM.
Lab
- Finish all ten projects on one practice machine.
- Keep a notebook of image sizes before and after shrink.
- Never store registry tokens in commit history.
- After each project, write one paragraph: what broke and how you fixed it.
- Retag once to a private registry and confirm pull still works.
Practice task
Pick the Compose three-tier lab and the image shrink lab. Prove both with curl and docker images size lines.
Ravindra Bagale's Tip
Do the projects in order on one practice machine. Pin every FROM tag. Never commit registry passwords.
एक practice machine वर projects क्रमाने करा. प्रत्येक FROM tag pin करा. Registry passwords कधीच commit करू नका.
एक practice machine पर projects क्रम से करें. हर FROM tag pin करें. Registry passwords कभी commit न करें.
In short
- Pin every base image tag.
- Multi-stage keeps build tools out of production.
- Named volumes keep database data.
- Private registries need volumes and digests.
- ECR login uses get-login-password or OIDC.
- Measure size before you shrink.