Copy docker image from one AWS ECR repo to another

Question

We want to copy a docker image from non-prod to prod ECR account. Is it possible without pulling, retaging and pushing it again.

Answer 1

No you have to run these commands

docker login OLD_REPO
docker pull OLD_REPO/IMAGE:TAG
docker tag OLD_REPO/IMAGE:TAG NEW_REPO/IMAGE:TAG
docker login NEW_REPO
docker push NEW_REPO/IMAGE:TAG

Answer 2

I have written this program in python to migrate all the images (or a specific image) from a repository to another region or to another account in a different region https://gist.github.com/fabidick22/6a1962697357360f0d73e01950ae962b

Answer 3

a slight improvement ( and may be couple of bug fixes on ) this answer: https://stackoverflow.com/a/69905254/65706

set -e

################################# UPDATE THESE #################################
LAST_N_TAGS=10

SRC_AWS_REGION="us-east-1"
TGT_AWS_REGION="eu-central-1"

SRC_AWS_PROFILE="your_source_aws_profile"
TGT_AWS_PROFILE="your_target_aws_profile"

SRC_BASE_PATH="386151140899.dkr.ecr.$SRC_AWS_REGION.amazonaws.com"
TGT_BASE_PATH="036149202915.dkr.ecr.$TGT_AWS_REGION.amazonaws.com"
#################################################################################

URI=($(aws ecr describe-repositories --profile $SRC_AWS_PROFILE --query 'repositories[].repositoryUri' --output text --region $SRC_AWS_REGION))
NAME=($(aws ecr describe-repositories  --profile $SRC_AWS_PROFILE --query 'repositories[].repositoryName' --output text --region $SRC_AWS_REGION))

echo "Start repo copy: `date`"

# source account login
aws --profile $SRC_AWS_PROFILE --region $SRC_AWS_REGION ecr get-login-password | docker login --username AWS --password-stdin $SRC_BASE_PATH
# destination account login
aws --profile $TGT_AWS_PROFILE --region $TGT_AWS_REGION ecr get-login-password | docker login --username AWS --password-stdin $TGT_BASE_PATH


for i in ${!URI[@]}; do
  echo "====> Grabbing latest $LAST_N_TAGS from ${NAME[$i]} repo"
  # create ecr repo if one does not exist in destination account
  aws ecr --profile $SRC_AWS_PROFILE --region $SRC_AWS_REGION describe-repositories --repository-names ${NAME[$i]} || aws ecr --profile $TGT_AWS_PROFILE --region $TGT_AWS_REGION create-repository --repository-name ${NAME[$i]}

  for tag in $(aws ecr describe-images --repository-name ${NAME[$i]} \
    --query 'sort_by(imageDetails,& imagePushedAt)[*]' \
    --filter tagStatus=TAGGED --output text \
    | grep IMAGETAGS | awk '{print $2}' | tail -$LAST_N_TAGS); do

    # if [[ ${NAME[$i]} == "repo-name/frontend-nba" ]]; then
    #   continue
    # fi
    # # 386517340899.dkr.ecr.us-east-1.amazonaws.com/spectralha-api/white-ref-detector
    # if [[ ${NAME[$i]} == "386351741199.dkr.ecr.us-east-1.amazonaws.com/repo-name/white-ref-detector" ]]; then
    #   continue
    # fi


    echo "START ::: pulling image ${URI[$i]}:$tag"
    AWS_REGION=$SRC_AWS_REGION AWS_PROFILE=$SRC_AWS_PROFILE docker pull ${URI[$i]}:$tag
    AWS_REGION=$SRC_AWS_REGION AWS_PROFILE=$SRC_AWS_PROFILE docker tag ${URI[$i]}:$tag $TGT_BASE_PATH/${NAME[$i]}:$tag
    echo "STOP  ::: pulling image ${URI[$i]}:$tag"

    echo "START ::: pushing image $TGT_BASE_PATH/${NAME[$i]}:$tag"
    # status=$(AWS_REGION=$TGT_AWS_REGION AWS_PROFILE=$TGT_AWS_PROFILE docker push $TGT_BASE_PATH/${NAME[$i]}:$tag)
    # echo $status
    AWS_REGION=$TGT_AWS_REGION AWS_PROFILE=$TGT_AWS_PROFILE docker push $TGT_BASE_PATH/${NAME[$i]}:$tag
    echo "STOP ::: pushing image $TGT_BASE_PATH/${NAME[$i]}:$tag"
    sleep 2
    echo ""
  done
  # docker image prune -a -f #clean-up ALL the images on the system
done

echo "Finish repo copy: `date`"
echo "Don't forget to purge you local docker images!"
#Uncomment to delete all
#docker rmi $(for i in ${!NAME[@]}; do docker images | grep ${NAME[$i]} | tr -s ' ' | cut -d ' ' -f 3 | uniq; done) -f

Answer 4

Answer: No, you must pull, tag, and push.

I wrote a bash script for this today. You can specify the number of tagged images that will be copied.

https://gist.github.com/virtualbeck/a635ef6701991f2087384eab7edbb18b