Amazon Elastic Container Registry (ECR)
Storing container images in Amazon ECR.
Last updated
Was this helpful?
Storing container images in Amazon ECR.
Last updated
Was this helpful?
The AWS container registry is a flavor provided with the ZenML aws integration and uses to store container images.
You should use the AWS container registry if:
one or more components of your stack need to pull or push container images.
you have access to AWS ECR. If you're not using AWS, take a look at the other .
The ECR registry is automatically activated once you create an AWS account. However, you'll need to create a Repository in order to push container images to it:
Go to the .
Make sure the correct region is selected on the top right.
Click on Create repository.
Create a private repository. The name of the repository depends on the or you're using in your stack.
The AWS container registry URI should have the following format:
To figure out the URI for your registry:
Once you have both these values, fill in the values in this template <ACCOUNT_ID>.dkr.ecr.<REGION>.amazonaws.com to get your container registry URI.
To use the AWS container registry, we need:
The ZenML aws integration installed. If you haven't done so, run
We can then register the container registry and use it in our active stack:
With the AWS CLI installed and set up with credentials, we'll need to log in to the container registry so Docker can pull and push images:
Go to the and click on your user account in the top right to see the Account ID.
Go and choose the region in which you would like to store your container images. Make sure to choose a nearby region for faster access.
installed and running.
The registry URI. Check out the on the URI format and how to get the URI for your registry.
You also need to set up required to log in to the container registry.
Integrating and using an AWS Container Registry in your pipelines is not possible without employing some form of authentication. If you're looking for a quick way to get started locally, you can use the Local Authentication method. However, the recommended way to authenticate to the AWS cloud platform is through . This is particularly useful if you are configuring ZenML stacks that combine the AWS Container Registry with other remote stack components also running in AWS.
This method uses the Docker client authentication available in the environment where the ZenML code is running. On your local machine, this is the quickest way to configure an AWS Container Registry. You don't need to supply credentials explicitly when you register the AWS Container Registry, as it leverages the local credentials and configuration that the AWS CLI and Docker client store on your local machine. However, you will need to install and set up the AWS CLI on your machine as a prerequisite, as covered in , before you register the AWS Container Registry.
Stacks using the AWS Container Registry set up with local authentication are not portable across environments. To make ZenML pipelines fully portable, it is recommended to use to link your AWS Container Registry to the remote ECR registry.
To set up the AWS Container Registry to authenticate to AWS and access an ECR registry, it is recommended to leverage the many features provided by such as auto-configuration, local login, best security practices regarding long-lived credentials and fine-grained access control and reusing the same credentials across multiple stack components.
A non-interactive CLI example that leverages on your local machine to auto-configure an AWS Service Connector targeting an ECR registry is:
Note: Please remember to grant the entity associated with your AWS credentials permissions to read and write to one or more ECR repositories as well as to list accessible ECR repositories. For a full list of permissions required to use an AWS Service Connector to access an ECR registry, please refer to the or read the documentation available in the interactive CLI commands and dashboard. The AWS Service Connector supports with different levels of security and convenience. You should pick the one that best fits your use case.
Linking the AWS Container Registry to a Service Connector means that your local Docker client is no longer authenticated to access the remote registry. If you need to manually interact with the remote registry via the Docker CLI, you can use the to temporarily authenticate your local Docker client to the remote registry:
For more information and a full list of configurable attributes of the AWS container registry, check out the .
