AWS ECR — Private Container Registry Pipeline

The problem

Keeping proprietary application images on the local machine or on public Docker Hub meant no access control, no encryption at rest and no reliable way for AWS services to pull the image. Deployments needed a private, IAM-governed registry that ECS, EKS and Lambda could pull from instantly.

What I built

1. 01

   Built the application image locally from the Dockerfile with docker build -t web-app .

2. 02

   Created a private ECR repository in us-east-1 via the AWS CLI: aws ecr create-repository --repository-name web-app --region us-east-1.

3. 03

   Authenticated the local Docker CLI against the registry with aws ecr get-login-password piped into docker login --password-stdin, so credentials are never stored in shell history.

4. 04

   Tagged the local build with the full registry URI (872515293031.dkr.ecr.us-east-1.amazonaws.com/web-app:latest) so Docker knows which account, region and repository the image belongs to, then pushed it.

5. 05

   Pointed the Compose web service at the ECR image URI and ran docker-compose pull followed by docker compose up -d --force-recreate to rebuild the stack from the cloud image, tearing it down cleanly with docker-compose down.

6. 06

   Verified the push through the ECR console (image index, digests, size) and with aws ecr describe-images from the CLI.