Docker Image tagging in ECR

Question

I am pushing docker image in AWS ECR using Jenkins.

While pushing the image i am providing tag as $Build_Number.So in ECR repo i have images with tags like 1,2,3,4.

But when i am trying to pull the image from EC2 with below command from Jenkins job

       docker pull 944XXX.dkr.ecr.us-east-1.amazonaws.com/repository1:latest

I am getting error as there is no image with tag as latest.

Here i want to pull the latest image (with tag 4).I cannot hard-code tag number here as docker pull command will run from Jenkins job automatically.So what way i can pull the latest image?

Answer 1

I believe that the correct approach here would be to push the same image twice with different tags. One push would include the image with no tag and then the second push would be the same image after you have tagged it.

Note that you don't have to build the image twice. You only need to issue the docker push twice.

ECR is "smart" enough to recognise that the image digest did not change and it will not try to actually upload the image twice. On the second push only the tag will be send to ECR.

Now that you have an untagged version and a tagged version, you can pull the image without the tag specification and you will get the :latest image. Here is a reference to the AWS docs where they mention that the :latest tag will be added if no tag was sent by the user.

The flow would look something like this:

# Build the image
docker build -f ./Dockerfile -t my-web-app
# Push the untagged image (will become the ":latest")
docker push my-web-app
# Tag the image with your build_number
docker tag my-web-app my-web-app:build_number
# Push the tagged image 
docker push my-web-app:build_number

You will now be able to:

docker pull my-web-app:build_number
docker pull my-web-app

Which will result in 2 identical images with only the tag differentiating between them.

Answer 2

one solution is suggested by @Lix that you can try, or if you are interested with just latest pushed image and no matter whats the tag of a latest image then you can get the latest image from AWS-CLI.

So your Jenkins job command will be

TAG=$(aws ecr describe-images --output json --repository-name stage/redis --query 'sort_by(imageDetails,& imagePushedAt)[-1].imageTags[0]' | jq . --raw-output)
docker pull 944XXX.dkr.ecr.us-east-1.amazonaws.com/repository1:$TAG

aws-cli-ecr-list-images-get-newest

Answer 3

If you want a latest tag on ECR, you need to add it and push it there when you build the image. You can use the -t to docker build multiple times (see https://docs.docker.com/v17.09/engine/reference/commandline/build/ ); just make sure to push them all.