80.6 Project 72: Build and push a Docker image to Amazon ECR

echo 'ECR holds images close to EKS with IAM controls'

mkdir -p /tmp/jen72/app && echo 'Today: Dockerfile, ecr login, SHA tag, push'

echo 'Never deploy :latest to production'

printf '%s\n' 'FROM public.ecr.aws/docker/library/nginx:1.27-alpine' 'COPY index.html /usr/share/nginx/html/index.html' > /tmp/jen72/app/Dockerfile && cat /tmp/jen72/app/Dockerfile

printf '%s\n' 'shop cart from jenkins' > /tmp/jen72/app/index.html && cat /tmp/jen72/app/index.html

echo 'Pin base tags; avoid FROM nginx:latest'

echo 'aws ecr create-repository --repository-name shop/cart --region ap-south-1'

printf '%s\n' 'ACCOUNT=123456789012' 'REGION=ap-south-1' 'REPO=shop/cart' > /tmp/jen72/ECR.env && cat /tmp/jen72/ECR.env

echo 'Image URI = ACCOUNT.dkr.ecr.REGION.amazonaws.com/REPO'

printf '%s\n' '    stage(\'ECR Login\') {' '      steps {' '        sh \'aws ecr get-login-password --region $REGION | docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com\'' '      }' '    }' > /tmp/jen72/LOGIN.txt && cat /tmp/jen72/LOGIN.txt

echo 'Agent needs AWS credentials via instance role or short-lived keys'

echo 'docker login writes to the agent docker config — cleanWs later'

printf '%s\n' '    stage(\'Build\') {' '      steps {' '        script { env.GIT_SHA = sh(returnStdout: true, script: \'git rev-parse --short HEAD\').trim() }' '        sh \'docker build -t $ACCOUNT.dkr.ecr.$REGION.amazonaws.com/$REPO:$GIT_SHA .\'' '      }' '    }' > /tmp/jen72/BUILD.txt && head -6 /tmp/jen72/BUILD.txt

echo 'Short SHA keeps tags readable; full SHA also fine'

echo 'Build context is the repo root with the Dockerfile'

printf '%s\n' '    stage(\'Push\') {' '      steps {' '        sh \'docker push $ACCOUNT.dkr.ecr.$REGION.amazonaws.com/$REPO:$GIT_SHA\'' '      }' '    }' > /tmp/jen72/PUSH.txt && cat /tmp/jen72/PUSH.txt

echo 'Copy the digest line from the push output into the build description'

echo 'Optional: also tag and push :build-$BUILD_NUMBER for humans'

printf '%s\n' 'agent { label \'docker\' }' 'Agent user must be in the docker group' > /tmp/jen72/AGENT.txt && cat /tmp/jen72/AGENT.txt

echo 'Prefer DinD carefully; rootless or mounted docker.sock with review'

echo 'Same agent role from Ansible project 66 works here'

echo 'aws ecr describe-images --repository-name shop/cart --image-ids imageTag=$GIT_SHA'

echo 'docker pull URI:SHA && docker image inspect URI:SHA --format '{{.Id}}''

printf '%s\n' 'Acceptance: describe-images shows the SHA tag' > /tmp/jen72/ACCEPT.txt && cat /tmp/jen72/ACCEPT.txt

printf '%s\n' 'ECR lifecycle: expire untagged after 14 days' 'Keep last 20 prod SHA tags' > /tmp/jen72/LIFECYCLE.txt && cat /tmp/jen72/LIFECYCLE.txt

echo 'Untagged layers appear after retags — clean them'

echo 'Scan on push can be enabled in ECR settings'

printf '%s\n' 'At Amazon Pay India partner team in Bengaluru, latest was retagged over a good image and pods pulled a broken layer.' 'Kabir required SHA tags from Jenkins and banned latest in prod.' > /tmp/jen72/STORY.txt && wc -l /tmp/jen72/STORY.txt

echo 'Rough cost: about ₹22 lakh in failed payments that hour'

echo 'Kabir: PASS'

ls /tmp/jen72 /tmp/jen72/app

grep GIT_SHA /tmp/jen72/BUILD.txt | head -1

echo 'Next: Deploy to EKS from Jenkins project 73'

echo 'Image pushed with git SHA tag'

echo 'describe-images confirms tag'

echo 'No latest used for prod deploy'