Push docker image to private ECR ?

[rgarrigue]

Hi there

I'm trying to push a docker image to a private ECR.

  • docker images
    • building docker image                          image=1234567890.dkr.ecr.eu-central-1.amazonaws.com/rainbow:1.1.2
  • publishing
    • docker images
      • pushing                                      image=1234567890.dkr.ecr.eu-central-1.amazonaws.com/rainbow:1.1.2
  ⨯ release failed after 2m41s               error=docker images: failed to publish artifacts: failed to push 1234567890.dkr.ecr.eu-central-1.amazonaws.com/rainbow:1.1.2: exit status 1: no basic auth credentials
The push refers to repository [1234567890.dkr.ecr.eu-central-1.amazonaws.com/rainbow]
a3bf08f97d50: Preparing

My .gitlab-ci.yml

stages:
  - release

release:
  stage: release
  tags:
    - aws-developers-runner
  image:
    name: goreleaser/goreleaser
    entrypoint: [""]
  only:
    - tags
  variables:
    # Disable shallow cloning so that goreleaser can diff between tags to
    # generate a changelog.
    GIT_DEPTH: 0
  script:
    - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
    - goreleaser release --clean

And the .goreleaser.yml (removed gitlab config, changelog, before hooks,

# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
# vim: set ts=2 sw=2 tw=0 fo=cnqojbefore:
---
builds:
  - env:
      - CGO_ENABLED=0
    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64

dockers:
  - image_templates:
      - "728080024150.dkr.ecr.eu-central-1.amazonaws.com/rainbow:{{ .Version }}"
      - "728080024150.dkr.ecr.eu-central-1.amazonaws.com/rainbow:{{ .Tag }}"
      - "728080024150.dkr.ecr.eu-central-1.amazonaws.com/rainbow:{{ .Major }}"
      - "728080024150.dkr.ecr.eu-central-1.amazonaws.com/rainbow:{{ .Major }}.{{ .Minor }}"
      - "728080024150.dkr.ecr.eu-central-1.amazonaws.com/rainbow:latest"
    dockerfile: Dockerfile
    build_flag_templates:
      - --label=org.opencontainers.image.title={{ .ProjectName }}
     ...

I added a docker login in the gitlab-ci.yml, no success still the same error. Tried an over privileged EC2 gitlab runnertoo, not better. Last I tried moving the docker login to goreleaser pre-hook, didn't worked. What am I missing ?

[caarlos0]

it definitely looks like you haven't log in into ECR... that said, I'm not well-versed in gitlab so I can't really assess if the gitlab ci config is valid, but the goreleaser one, assuming you are logged in into ecr, seems ok.

[rgarrigue]

So it was my bad : docker login was logging against Gitlab own registry, successfully but wasn't where I wanted to push. Fixing .gitlab-ci.yml like this work (also because my runner got the proper IAM profile for aws ecr get-login-password to work)

  script:
    - apk add aws-cli
    - aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin 1234567890.dkr.ecr.eu-central-1.amazonaws.com
    - goreleaser release --clean

Thanks for implicitely confirming that it wasn't about some goreleaser trick I missed out.

Maybe the above snippet would be nice in the doc as an example about dealing with private registry. I found no reference on the topic to at least tell me there's indeed something to do, even if the doc case doesn't apply to my own situation.

[caarlos0]

Ah cool!

If you feel like docs need improvements and would like to contribute, feel free to do so.

All the docs live under www, there's a task in Taskfile.yml to test it locally, and opening a pr deploy to a temp URL as well 👌