Is it possible for Bitbucket pipeline to build a docker image from private ECR base image?

Shuo Hua

In our pipeline we would like to build a docker image that uses a base image from a private AWS ECR and then push the build image to our AWS ECR. However when doing that following the standard setup, we got following error:

<span>Sending build context to Docker daemon  3.072kB</span>

<span>Step 1/6 : FROM <AWS-ECR>/<base-image></span>

<span>Head FROM <AWS-ECR>/v2/<base-image>/manifests/latest: no basic auth credentials</span><span>docker build -t <image-name> .</span>

---

Our pipeline setup is the following

custom:
    build_and_push_to_ecr:
        - step:
            service:
                - docker
            script:
                - export AWS_REGION=<AWS-REGION>
                - export AWS_ACCESS_KEY_ID=<AWS-ACCESS-KEY-ID_THEIRS>
                - export AWS_SECRET_ACCESS_KEY=<AWS-SECRET-ACCESS-KEY_THEIRS>                
                - docker build -t <image-name> .
                - pipe: atlassian/aws-ecr-push-image:1.4.2
                  variables:
                      AWS_ACCESS_KEY_ID: <AWS-ACCESS-KEY-ID_OURS>
                      AWS_SECRET_ACCESS_KEY: <AWS-SECRET-ACCESS-KEY_OURS>
                      AWS_DEFAULT_REGION: <AWS-REGION>
                      DEBUG: 'true'
                      IMAGE_NAME: <NAME>
                      TAGS: ${BITBUCKET_BRANCH}

The Dockerfile we want to build looks like

<span>FROM <AWS-ECR>/<base-image><br><br>...</span>

---

So is it possible for the docker service to build with a private base image or it must be public?

Ankit Gupta_1v4hbj

Your docker is not logged in with the AWS ECR credentials. You need to add the below line to the script before `docker build`:

 aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ECR