managing container images with amazon ecr - aws online tech talks
TRANSCRIPT
![Page 1: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/1.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Mitch Beaumont, Solutions Architect
& Shai Perednik, Cloud Infrastructure Architect
November 2017
Introduction to Amazon ECRAmazon EC2 Container Registry
![Page 2: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/2.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What will we cover today?
• The AWS Container Ecosystem
• What is Amazon ECR
• Features of Amazon ECR
• Amazon ECR in action
![Page 3: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/3.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shai Perednik
Senior Cloud Infrastructure Architect
AWS Professional Services NYC
20 YRS in IT
Moved from CA -> PA
![Page 4: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/4.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Container Ecosystem
EC2 Container Service
EC2 Container
Registry
ECS
CLI
![Page 5: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/5.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is Amazon EC2 Container Registry (ECR)?
Fully Managed Secure Highly Available Simplified Workflow
![Page 6: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/6.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Anatomy of a Docker Image
![Page 7: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/7.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Images
Packaged
application code
Reproducible Immutable Portable
![Page 8: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/8.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Images
747cb2d60bbe
a8bdc7fdaa4f
1f7916b037e5
Layers
Image
Layer Data
hello-ecr:latest
![Page 9: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/9.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
![Page 10: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/10.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
I have a Docker
image, and I want to
run the image on a
cluster
![Page 11: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/11.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECR
![Page 12: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/12.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECS
![Page 13: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/13.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical User Workflow
Amazon
ECS
Amazon
ECR
![Page 14: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/14.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ECR Components
Amazon ECR
• Registry & Repository
• Registry Policy
• Image
• Authorization Token
![Page 15: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/15.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pricing & Availability
• Available in 13 regions
• 12-month free tier for 500MB image storage
• $0.10 per GB / month Docker image storage pricing
• Standard AWS Data Transfer Rate
![Page 16: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/16.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Features and Integrations
![Page 17: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/17.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Container Service Integration
• EC2 instances must have the following IAM permissions:
ecr:BatchCheckLayerAvailability
ecr:BatchGetImage
ecr:GetDownloadUrlForLayer
ecr:GetAuthorizationTokenIAM
![Page 18: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/18.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon EC2 Container Service Integration
• Use the
AmazonEC2ContainerServiceforEC2Role
managed policy.
• Task definitions must use the full
registry/repository:tag naming for images.
![Page 19: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/19.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Registry V2 API
![Page 20: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/20.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Support
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon1. Fetches image manifest at tag
2. For each layer that it doesn’t have:
1. Fetch layer
![Page 21: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/21.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Docker Support
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon1. Fetches image manifest at tag
2. For each layer that it doesn’t have:
1. Fetch layer
Pulling an Image
$docker pull <registry-uri>/image-name:tag
Docker daemon1. GET /v2/<image-name>/manifests/<tag>
2. For each layer that it doesn’t have:
1. GET /v2/<image-name>/blobs/<digest>
HTTP
![Page 22: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/22.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon S3 High Availability and Durability
• Highly scalable object storage
• Store and retrieve files from anywhere on the web
• Files are stored as objects and organised in to high-level
folders called buckets
• Supports multi-part upload for large files and event
notifications when objects change
• Files up to 5TB in size
![Page 23: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/23.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Team Collaboration
Amazon
ECRteam-a/web-app team-b/web-app
https://205094881157.dkr.ecr.us-west-2.amazonaws.com
![Page 24: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/24.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Access Control
instance
Production/web-app
Developer
{ “ecr:PutImage”,“ecr:InitiateLayerUpload”,“ecr:UploadLayerPart”,“ecr:CompleteLayerUpload”,“ecr:GetAuthorizationToken”
}
{“ecr:BatchCheckLayerAvailability”,“ecr:BatchGetImage”,“ecr:GetDownloadUrlForLayer”,“ecr:GetAuthorizationToken”
}
![Page 25: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/25.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Encryption
Amazon ECR
AWS KMS
Images
transferred by
HTTPS Automatically
encrypted at rest
using Amazon S3
server-side
encryption
![Page 26: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/26.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Third-party Integrations
![Page 27: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/27.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Creating a registry
Demo
![Page 28: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/28.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Pushing and image with the AWS CLI
Demo
![Page 29: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/29.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building and Pushing and image with Code*
Demo
![Page 30: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/30.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task Definitions and Container Images
Demo
![Page 31: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/31.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ECR Lifecycle Policies
Demo
![Page 32: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/32.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Optimising Performance for ECR
• Use Docker 1.10
• Use smaller base images
• Understand your dependencies
• Chain commands
• Use closest regional endpoint
![Page 33: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/33.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What we’ve covered today
• ECR is a fully managed Docker
image registry
• Compatible with Docker Registry
v2 API
• Integrates with Amazon EC2
Container Service
• Fine grained access control
• Cloudtrail integration.
![Page 34: Managing Container Images with Amazon ECR - AWS Online Tech Talks](https://reader035.vdocuments.net/reader035/viewer/2022062317/5a64799b7f8b9a3b568b47b3/html5/thumbnails/34.jpg)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!Questions?