ECR & Container Registry

Registry Model

ECR is a private, regional OCI registry: repositories hold image tags, and images are content-addressed layers shared across tags. Regional matters — CI pushes in us-east-1 do not automatically appear in eu-west-1; plan replication or build per region.

Three controls shape hygiene: tag mutability (IMMUTABLE prevents re-pushing an existing tag — the fix for "latest changed under us"), lifecycle policies (delete untagged images or cap count per repository so storage does not grow forever), and scan on push (basic scanning for known CVEs, or Enhanced scanning with Amazon Inspector for deeper coverage). Pull-through cache can front Docker Hub so CI does not lean on the public rate limits.

Push, Pull, Share

aws ecr get-login-password --region us-east-1 |
  docker login --username AWS --password-stdin
    123456789012.dkr.ecr.us-east-1.amazonaws.com

docker build -t myapp:abc123 .
docker tag myapp:abc123 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:abc123
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:abc123

Tokens are short-lived (valid up to 12 hours), so CI should request one per pipeline run rather than caching it. Cross-account pulls use a repository policy granting ecr:GetDownloadTokenForLayer and friends to the other account's principal, plus a KMS key policy when the repository uses a CMK.

Pitfalls and Interview Focus

Lifecycle policies are aggressive by default of your rules: maxImageCount: 5 can delete an image that a running task still references — a new task then fails to pull during the next deploy. Exclude recent images or untagged-only rules during active rollouts.

Other traps: IAM auth works only where the principal's identity policy and the repository policy both allow — one missing side yields AccessDenied; latest plus mutable tags means deploys are unreproducible (pin digests or SHAs); scan-on-push reports arrive asynchronously, so a pipeline that checks findings immediately races the scanner.

Interview: describe promotion (build → scan gate → deploy by digest) and one control that prevents drift (immutable tags or lifecycle rules).