AWS ECR Container Registry

Managed Docker registry with IAM auth, image scanning, lifecycle policies, and cross-region replication.

AWSBeginner

Why

ECR integrates with ECS/EKS via IAM — no Docker Hub credentials to manage. Image scanning finds CVEs.

Lifecycle policies auto-clean old images. $0.10/GB/mo storage.

When

Use for any AWS container deployment. Avoid for public images (use Docker Hub) or multi-cloud (use GHCR).

How

1. Create repo — aws ecr create-repository --repository-name my-app 2. Auth — aws ecr get-login-password | docker login 3. Push — docker tag, docker push 123.dkr.ecr.us-east-1.amazonaws.com/my-app:v1 4. Scan — on push (basic/enhanced), Inspector for deep CVE 5. Lifecycle — auto-delete untagged or old images 6. Cross-region — replicate to other regions for faster pulls 7. Pull-through cache — proxy Docker Hub, avoid rate limits 8. Immutable tags — prevent overwriting, force version bump

Example

# Auth and push aws ecr get-login-password --region us-east-1 | \ docker login --username AWS --password-stdin 123.dkr.ecr.us-east-1.amazonaws.com docker tag my-app:latest 123.dkr.ecr.us-east-1.amazonaws.com/my-app:v1 docker push 123.dkr.ecr.us-east-1.amazonaws.com/my-app:v1 # Lifecycle — keep last 10 images aws ecr put-lifecycle-policy --repository-name my-app --lifecycle-policy-text '{ "rules": [{ "rulePriority": 1, "description": "keep 10", "selection": { "tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 10 }, "action": { "type": "expire" } }] }'

Common Problems

⚠Old images accumulate — set lifecycle policy, auto-delete untagged and old
⚠Scan findings ignored — fail CI on CRITICAL CVEs, not just report
⚠Cross-region pull slow — replicate to deployment regions

Best Practices

✓Enable enhanced scanning — Inspector integration, deeper CVE detection
✓Set lifecycle policy — auto-clean old images, controls storage cost
✓Use immutable tags — prevents overwriting, ensures reproducible deploys

FAQ

What is AWS ECR Container Registry and what problem does it solve?

Managed Docker registry with IAM auth, image scanning, lifecycle policies, and cross-region replication. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with AWS ECR Container Registry in 5 minutes?

Two steps to run it: (1) Create repo — aws ecr create-repository --repository-name my-app; (2) Auth — aws ecr get-login-password | docker login. Validate on the free tier first, then wire into production.

What is the #1 pitfall with AWS ECR Container Registry?

The most frequent issue is: Old images accumulate — set lifecycle policy, auto-delete untagged and old. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for AWS ECR Container Registry?

Best practices for AWS ECR Container Registry include: Enable enhanced scanning — Inspector integration, deeper CVE detection; Set lifecycle policy — auto-clean old images, controls storage cost; Use immutable tags — prevents overwriting, ensures reproducible deploys. The first one — "Enable enhanced scanning — Inspector integration, deeper CVE detection" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with AWS ECR Container Registry?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most AWS ECR Container Registry options offer a free tier — validate within free quota before scaling.