The document discusses Amazon EC2 Container Registry (ECR), which is a fully managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. It provides details on what ECR is, how it integrates with other AWS services like ECS, its access control and encryption features, and demos of common user workflows like creating a registry, pushing images, and using images in tasks.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Mitch Beaumont, Solutions Architect
& Shai Perednik, Cloud Infrastructure Architect
November 2017
Introduction to Amazon ECR
Amazon EC2 Container Registry

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What will we cover today?
• The AWS Container Ecosystem
• What is Amazon ECR
• Features of Amazon ECR
• Amazon ECR in action

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shai Perednik
Senior Cloud Infrastructure Architect
AWS Professional Services NYC
20 YRS in IT
Moved from CA -> PA

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Container Ecosystem
EC2 Container Service
EC2 Container
Registry
ECS
CLI

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is Amazon EC2 Container Registry (ECR)?
Fully Managed Secure Highly Available Simplified Workflow

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Anatomy of a Docker Image

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Images
Packaged
application code
Reproducible Immutable Portable

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Images
747cb2d60bbe
a8bdc7fdaa4f
1f7916b037e5
Layers
Image
Layer Data
hello-ecr:latest

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
I have a Docker
image, and I want to
run the image on a
cluster

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECR

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECS

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECS
Amazon
ECR

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ECR Components
Amazon ECR
• Registry & Repository
• Registry Policy
• Image
• Authorization Token

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pricing & Availability
• Available in 13 regions
• 12-month free tier for 500MB image storage
• $0.10 per GB / month Docker image storage pricing
• Standard AWS Data Transfer Rate

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Features and Integrations

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Container Service Integration
• EC2 instances must have the following IAM permissions:
ecr:BatchCheckLayerAvailability
ecr:BatchGetImage
ecr:GetDownloadUrlForLayer
ecr:GetAuthorizationToken
IAM

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Container Service Integration
• Use the
AmazonEC2ContainerServiceforEC2Role
managed policy.
• Task definitions must use the full
registry/repository:tag naming for images.

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Registry V2 API

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Support
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon
1. Fetches image manifest at tag
2. For each layer that it doesn’t have:
1. Fetch layer

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Support
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon
1. Fetches image manifest at tag
2. For each layer that it doesn’t have:
1. Fetch layer
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon
1. GET /v2/<image-name>/manifests/<tag>
2. For each layer that it doesn’t have:
1. GET /v2/<image-name>/blobs/<digest>
HTTP

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon S3 High Availability and Durability
• Highly scalable object storage
• Store and retrieve files from anywhere on the web
• Files are stored as objects and organised in to high-level
folders called buckets
• Supports multi-part upload for large files and event
notifications when objects change
• Files up to 5TB in size

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Team Collaboration
Amazon
ECR
team-a/web-app team-b/web-app
https://205094881157.dkr.ecr.us-west-2.amazonaws.com

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Access Control
instance
Production/web-app
Developer
{
“ecr:PutImage”,
“ecr:InitiateLayerUpload”,
“ecr:UploadLayerPart”,
“ecr:CompleteLayerUpload”,
“ecr:GetAuthorizationToken”
}
{
“ecr:BatchCheckLayerAvailability”,
“ecr:BatchGetImage”,
“ecr:GetDownloadUrlForLayer”,
“ecr:GetAuthorizationToken”
}

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Encryption
Amazon ECR
AWS KMS
Images
transferred by
HTTPS Automatically
encrypted at rest
using Amazon S3
server-side
encryption

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Third-party Integrations

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Creating a registry
Demo

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pushing and image with the AWS CLI
Demo

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building and Pushing and image with Code*
Demo

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task Definitions and Container Images
Demo

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ECR Lifecycle Policies
Demo

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Optimising Performance for ECR
• Use Docker 1.10
• Use smaller base images
• Understand your dependencies
• Chain commands
• Use closest regional endpoint

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What we’ve covered today
• ECR is a fully managed Docker
image registry
• Compatible with Docker Registry
v2 API
• Integrates with Amazon EC2
Container Service
• Fine grained access control
• Cloudtrail integration.

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!
Questions?