Create standalone docker file & allow it to be used for retrieving credentials manually

Dockerfile

@@ -11,10 +11,29 @@
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
 
-FROM golang:1.9
+FROM golang:1.9-alpine3.6 AS builder
 
-WORKDIR /go/src/github.com/awslabs/amazon-ecr-credential-helper
+COPY ecr-login /go/src/github.com/awslabs/amazon-ecr-credential-helper/ecr-login
 
-COPY . .
+RUN env CGO_ENABLED=0 go install -installsuffix "static" \
+    github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login
 
-CMD make
+# Taken from https://github.com/aws/amazon-ecs-agent/blob/ecda8a686200643081fe7de498b61b1c023b2c25/misc/certs/Dockerfile
+FROM debian:latest as certs
+
+RUN apt-get update &&  \
+    apt-get install -y ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# If anyone has a better idea for how to trim undesired certs or a better ca list to use, I'm all ears
+RUN cp /etc/ca-certificates.conf /tmp/caconf && \
+  cat /tmp/caconf | grep -v "mozilla/CNNIC_ROOT\.crt" > /etc/ca-certificates.conf && \
+  update-ca-certificates --fresh
+
+FROM scratch
+
+COPY --from=builder /go/bin/docker-credential-ecr-login /usr/local/bin/docker-credential-ecr-login
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+ENTRYPOINT [ "/usr/local/bin/docker-credential-ecr-login" ]
+CMD [ "eval" ]

build.Dockerfile

@@ -0,0 +1,20 @@
+# Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+#       http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+
+FROM golang:1.9
+
+WORKDIR /go/src/github.com/awslabs/amazon-ecr-credential-helper
+
+COPY . .
+
+CMD make

ecr-login/cli/docker-credential-ecr-login/main.go

@@ -44,5 +44,66 @@ func main() {
 
 	defer log.Flush()
 	config.SetupLogger()
-	credentials.Serve(ecr.ECRHelper{ClientFactory: api.DefaultClientFactory{}})
+	helper := ecr.ECRHelper{ClientFactory: api.DefaultClientFactory{}}
+	if len(os.Args) > 1 && os.Args[1] == "eval" {
+		evalCommand(helper)
+	} else {
+		credentials.Serve(helper)
+	}
+}
+
+func evalCommand(helper credentials.Helper) {
+	server, email, passwordStdin, err := parseArgs(helper)
+	if err == nil {
+		var user, token string
+		user, token, err = helper.Get(server)
+		if err == nil {
+			var emailOpt string
+			if email {
+				emailOpt = " -e none"
+			}
+			var echoPassword, passwordOpt string
+			if passwordStdin {
+				echoPassword = fmt.Sprintf("echo %s|", token)
+				passwordOpt = "--password-stdin"
+			} else {
+				passwordOpt = fmt.Sprintf("-p %s", token)
+			}
+
+			fmt.Printf("%sdocker login%s -u %s %s %s\n",
+				echoPassword, emailOpt, user, passwordOpt, server)
+		}
+	}
+	if err != nil {
+		fmt.Fprintf(os.Stdout, "%v\n", err)
+		os.Exit(1)
+	}
+}
+
+func parseArgs(helper credentials.Helper) (string, bool, bool, error) {
+	var err error
+	var email, passwordStdin bool
+	for i := 2; i < len(os.Args); i += 1 {
+		switch os.Args[i] {
+		case "-e":
+			email = true
+		case "--password-stdin":
+			passwordStdin = true
+		default:
+			err = fmt.Errorf("Usage: %s [-e] [--password-stdin]", os.Args[0])
+			break
+		}
+	}
+	if err == nil {
+		var servers map[string]string
+		servers, err = helper.List()
+		if err == nil {
+			// Return any server in the map
+			for k := range servers {
+				return k, email, passwordStdin, nil
+			}
+			err = fmt.Errorf("No default ECR servers found")
+		}
+	}
+	return "", false, false, err
 }