aws-samples / amazon-ecr-replication-for-pub-container-images

Amazon ECR replication for public container images

Public container images mirror solution

In the container community, most public container images are located in Docker Hub, Quay, and GCR. In order to get fast, stable, and secure access to these public images from Amazon ECS or EKS, it's recommended to replicate these images to Amazon ECR. There are 2 use cases to have replicated public container images in your private ECR container registry:

1. Replicate frequently used container images into ECR to get fast and stable access in conatiner platform.
2. Due to security and compliance consideration, you may need to have your ECS/EKS cluster in subnet without Internet access and use VPC PrivateLink to get access to ECR.

This solution is intended to demostrate an automated process to replicate public conatiner images into ECR by submitting your needed images list into AWS CodeCommit repository:

How It Works

1. The administrator will modify the required image path and its tag to images.txt and submit it to the AWS CodeCommit repository.
2. According to the preconfigured trigger rules, AWS CodeCommit will trigger AWS CodeBuild to start the build task.
3. The AWS CodeBuild build task pulls these images from the public image repository based on the image list in images.txt.
4. The AWS CodeBuild build task tags these images to make them point to the target ECR repository and then pushes these images to ECR repository.
5. Container management platforms such as Amazon ECS or EKS pull these images from the local ECR repository to run the containers.

How to Deploy

You may deploy this solution with AWS CDK to any AWS region.

1. Please follow Getting started with the AWS CDK to install AWS CLI, Node.js, and other tools.

2. Get access key ID (AK) and secret key (SK) for an AWS IAM user who has push/pull access to target ECR repository.

3. Clone this project and install required npm modules

$ git clone https://github.com/aws-samples/amazon-ecr-replication-for-pub-container-images.git
$ cd amazon-ecr-replication-for-pub-container-images
$ npm install

4. Deploy this solution with Amaozn ECR of another AWS account and region, replace targetRegion, targetRegionAK, and targetRegionSK with the region and IAM user credential.

$ npx cdk deploy --parameters targetRegion=cn-northwest-1 --parameters targetRegionAK=AKABCD12345 --parameters targetRegionSK=SK12345

5. Check out and commit the images.txt file into the CodeCommit repository. You may notice the images will be replicated to your ECR repository in the target AWS account.

How to Destroy the Stack

$ npx cdk destroy

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

amazon-ecr-replication-for-pub-container-images's Issues

关于部署的一点疑问

我按照 在 AWS **区方便安全的使用海外公开容器镜像进行部署，发现 CloudFormation、CodeCommit都部署在了国内的账户上，相应的，CodeBuild也是在国内账户上完成。

随后拉取镜像失败，报错信息如下：

Error response from daemon: Get https://gcr.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

我认为这个错误是由于在国内进行CodeBuild所导致的。

请问是上面的Blog文章哪里出了问题，还是我理解有误？毕竟现在的部署方式与图示也不相符（按图所示，CodeCommit与CodeBuild应该在海外IAM上完成吧）。

非常感谢您的杰出工作，也期待您的回复，谢谢！

Build Command execution errors due to targetRegion and ECR_DN

If we clone the repo and follow the steps mentioned in the document we get the following errors.

Get https://xxx.dkr.ecr.***.amazonaws.com.cn/v2/: dial tcp: lookup xxx.dkr.ecr.***.amazonaws.com.cn on 10.0.0.2:53: no such host 76 |   77 | [Container] 2024/02/15 02:17:39.123150 Command did not exit successfully echo "Hello, CodeBuild!, push to ${targetRegion}" 78 | bash ./mirror-images.sh 79 | exit status 1 80 | [Container] 2024/02/15 02:17:39.126557 Phase complete: BUILD State: FAILED 81 | [Container] 2024/02/15 02:17:39.126575 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: echo "Hello, CodeBuild!, push to ${targetRegion}"

部署到日本区报如下错误

环境：MAC
npm version：7.24.0
node.js version: v16.10.0

不知道为啥咋建立code commit repo的时候 报zip 包不合法