DOCKER-CREDENTIAL-ECR-LOGIN(1)

💅 DOCKER-CREDENTIAL-ECR-LOGIN(1) — Amazon ECR Credential Helper for Docker

okay bestie, sit down, we're learning about the Amazon ECR Credential Helper for Docker, from the manual AMAZON-ECR. this one is genuinely a glow-up for your container workflow, no cap. ✨

---

🌸 NAME

docker-credential-ecr-login — Amazon ECR Credential Helper for Docker

---

🎀 SYNOPSIS

docker-credential-ecr-login COMMAND

docker-credential-ecr-login -v

---

🦋 DESCRIPTION

so the Amazon ECR Credential Helper for Docker is literally a credential helper for the docker(1) command, and it makes storing and retrieving container images with Amazon Elastic Container Registry so much easier. that's it, that's the pitch, and it ate. 🔥

---

👑 USAGE

first things first: drop the docker-credential-ecr-login binary onto your PATH, and set the contents of your ~/.docker/config.json to be:

{
  "credsStore":"ecr-login"
}

then — and this is the upgrade era, bestie — if you have Docker 1.13.0 or greater, you can configure Docker to use different credential helpers for different registries. iconic. to use this credential helper for one specific ECR registry, make a credsHelper section with the URI of your ECR registry:

{
  "credHelpers": {
    "public.ecr.aws": "ecr-login",
    "aws_account_id.dkr.ecr.region.amazonaws.com": "ecr-login"
  }
}

and once it's installed? you may use docker pull and docker push with ECR repositories, without running docker login. the way that just works. 💅 periodt.

---

🔐 AWS CREDENTIALS

the credential helper reads your AWS credentials from the standard locations, which includes:

• environment variables
• the shared credentials file (~/.aws/credentials)
• EC2 instance profiles
• ECS task roles

if you wanna use credentials associated with a different named profile in the shared credentials file, just set the AWS_PROFILE environment variable. easy. 🫶

also — it reads and supports some configuration options specified in the shared configuration file (~/.aws/config). to disable these options, you must set the AWS_SDK_LOAD_CONFIG environment variable to false. the supported options include:

• Assumed roles specified with role_arn and source_profile
• External credential processes specified with credential_process
• Web Identities like IAM roles for Service Accounts in Kubernetes

and listen, the credentials must have a policy applied that allows access to Amazon ECR. the details live at http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html if you wanna go read them. 👀

---

✨ OPTIONS ✨

• -v — prints the version and the git commit used to build docker-credential-ecr-login. cute little receipt of what you're running.

---

🎯 COMMANDS

• get — retrieve credentials for a specific Amazon ECR registry. the registry should be passed to the credential helper via stdin(3), and the results will be printed to stdout(3). 🍓
• list — retrieve the names of each registry currently known to the helper. the helper will cache the names of all requested registries and return them here.
• version — return the version of the credential helper protocol implemented by this helper. (yes it's its own thing, and yes -v is separate, don't @ me.)
• store — this command is not implemented and is a no-op. 💀
• erase — this command is not implemented and is a no-op. 💀

---

🙈 BUGS

Kubernetes besties using the credential helper inside containers with a non-root user may encounter permission issues — they're described here: https://github.com/kubernetes-sigs/external-dns/pull/1185. you may be able to work around this bug by adjusting the Kubernetes securityContext. not ideal, but we adapt. 💜

---

©️ COPYRIGHT

Copyright Amazon.com, Inc. or its affiliates. All rights reserved.

---

📜 LICENSE

Licensed under the Apache License, version 2.0.

---

and that's the whole page, bb 💖 this one came from the AMAZON-WEB-SERVICES crew, dated 2018-10-29 — the manual name up top is AMAZON-ECR, and honestly? go pull something. you got this. 🧚⭐