Amazon Elastic Container Registry (ECR)
Amazon Elastic Container Registry (ECR) is a managed Amazon Web Services service that lets users store, manage, share, and deploy container images and other artifacts, functioning as a highly available and secure private container repository.
Key points
- Stores both containers created by the user and container software purchased through AWS Marketplace.
- AWS Identity and Access Management (IAM) enables resource-level control of each repository within ECR.
- Runs two distinct registry types: private registries (one per account, namespaced repositories, fine-grained IAM/repository policies) and the separate public Amazon ECR Public registry/gallery for anyone to discover and download images without authentication.
- Images are encrypted at rest using Amazon S3 server-side encryption or customer-managed keys via AWS Key Management Service (KMS).
- Integrated with continuous integration, continuous delivery, and third-party developer tools.
- Two image scanning modes: basic scanning (on push, using the open-source Clair engine) and enhanced scanning, which is integrated with Amazon Inspector and continuously rescans repositories for both OS and programming-language package vulnerabilities as new CVEs are published, not just at push time.
- Pull through cache repositories automatically sync and keep images from supported upstream registries — Docker Hub, ECR Public, Quay, GitHub Container Registry, Kubernetes Registry, Microsoft Azure Container Registry, GitLab Container Registry, and Chainguard — into a private ECR registry, reducing pull latency and applying ECR’s lifecycle policies and scanning to the cached copies.
- Encrypts and compresses images at rest so they are fast to pull and secure.
- ECR stores Docker images to be deployed by Amazon Elastic Container Service (ECS): ECS can pull images from ECR repositories and deploy them within ECS clusters.
- Example flow: GitLab builds images and pushes them to ECR, then AWS CodeDeploy triggers a script that pulls the images and starts the container inside an EC2 instance.