ECR – Elastic Container Registry

Pricing

Here is the Detailed Pricing Blog.

To stay free:

• Use public registry -> 50 GB/month storage free, always.
• Use small images and only pull from the internet or same region (not cross region, not from behind AWS NAT) -> only first 1GB free

Notes

• ECR is just another container registry, proprietary by AWS
• Public repos use aws ecr-pubilc module, private uses aws ecr module in aws cli

Pushing Images

• create repo in registry (public/private) -> everything is optional except name
• your image name should be in specific format (see bullet points ⬇)
• pushing to public repos -> see here
• pushing to private repos -> see here

Pushing Via Github Actions

AWS provides aws-actions/amazon-ecr-login to login into ECR and also samples to push image into repository – be it public or private. Here’s the general flow:

1. Checkout Github Repo -> actions/checkout
2. Login to AWS -> aws-actions/configure-aws-credentials
3. Login to ECR -> aws-actions/amazon-ecr-login (same for public/private)
4. Docker Build and Push -> docker build ... && docker push ...

    flowchart LR
    A[Checkout] --> B["Configure AWS"]
    B --> C["Login ECR"]
    C --> D["Build and Push"]
  

Sample Manifest

name: Push Image to ECR

on: [push]

permissions:
  contents: read

jobs:
  push-to-ecr:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: actions/checkout@v5

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v6
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    - name: Login to Amazon ECR Public
      id: login-ecr-public
      uses: aws-actions/amazon-ecr-login@v2
      with:
        registry-type: public

    - name: Push to ECR and Write Summary
      env:
        REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
        REGISTRY_ALIAS: <your-alias>
        REPOSITORY: demo/demo
        IMAGE_TAG: ${{ github.sha }}
        GALLERY: gallery.ecr.aws
      run: |
        # push using long sha
        docker build -t $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG .
        docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG
        # push latest too (same image as sha, just tag as latest)
        git tag $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:latest
        docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:latest
        # Write Summary
        cat >> "$GITHUB_STEP_SUMMARY" << EOF
        ## Image Details
        | Container Registry | Image |
        | ------------------ |-------|
        | [XYZ Entreprises](https://$GALLERY/$REGISTRY_ALIAS) | [$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY](https://$GALLERY/$REGISTRY_ALIAS/$REPOSITORY) |
        EOF

Pull-Through Cache

An Amazon ECR pull-through cache is a feature that allows your private Amazon Elastic Container Registry (ECR) to automatically mirror, sync, and store container images from external upstream registries. However you need to enable this feature in your private registry.

How It Works

• Initial Pull: When you request an image using your private ECR URL, Amazon ECR intercepts the request, fetches the image from the upstream registry on-demand, creates a matching private repository, and serves it to you.
• Subsequent Pulls: Future requests for that image are served directly from your local ECR private registry rather than going back to the external source.
• Automatic Sync: ECR periodically checks upstream registries (typically every 24 hours) to ensure cached tags remain updated

Supported Upstream Registries

• Amazon ECR Public
• Docker Hub (requires authentication via AWS Secrets Manager)
• GitHub Container Registry (GHCR)
• Microsoft Azure Container Registry (ACR)
• GitLab Container Registry (SaaS)
• Quay.io
• Kubernetes container image registry
• Chainguard Registry
• Amazon ECR (private cross-account or cross-region ECR)