push docker image to ECR

Oleg Sigida

Hi,

I'm building a docker image for a java app, so I use maven container for that.

Now, I want to push the image to ECR. ECR has very strict security so you have to loging with awscli every time you need yo push something (token is valid for 12h only)

To login you need to run something like "$(aws ecr get-login --no-include-email)" and provide AWS key and secret as an environemt variables.

The problem: my maven image (from docker hub) where the app is built does not have any python nor pip installed.

To merge python+pip+maven into a single docker image is a bit of a hassle (and maintance of course).

Maybe there is simpler way to login docker to ECR by some Bitbucket pluging? or maybe I can have a "pre build" step where I can get login string from awscli?

thanks a lot in advance for ideas!

Oleg Sigida

And there is a solution!

Steps feature with ability to define an image on the step level is a perfect fit for such kind of tasks.

 

so I defined 2 steps pipeline:

 

- step:
    name: Build Login-to-ECR script
image: python:3.6-alpine
script:
      - pip install awscli
      - echo $(aws ecr get-login --no-include-email --region eu-west-1) > login.sh
artifacts:
      - login.sh
caches:
      - pip
- step:
    name: Build the app
image: node:6-alpine
script:
      - sh login.sh

First step runs in a python container with aws cli installed. It executes get login sting command, and save it to a file. The file is shared with further steps via artifact notation.

So the second step, who supposed to build and upload docker image to the registry, just need to execute the login command.

Looks really nice, as I don't need to build and maintain custom images and use basic python and java (or any other) images instead.

 

PS: credentials for aws cli are provided via pipeline environment variables