Pull docker image from AWS ECR using remote API

Question

I have followed this post to try to download a Docker image from AWS ECR but I get the following errors:

If I do:

#!/bin/sh

repository="2xxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/nexus-pro"
tag="2.13.0-np-1.0"

ecr_token=$(aws ecr get-authorization-token --output text --query authorizationData[].authorizationToken | cut -d: -f2)

docker_login=$(echo "{\"username\":\"AWS\",\"password\":\"${ecr_token}\", \"auth\":\"\",\"email\":\"none\"}" | base64)

curl -X POST -d "" -H "X-Registry-Auth: ${docker_login}" http://${ip_address}:4243/images/create?fromImage=${repository}&tag=${tag_source}

Then I get the following error:

$ error parsing HTTP 403 response body: invalid character 'Y' looking for beginning of value: "Your Authorization Token has expired. Please run 'aws ecr get-login' to fetch a new one."

Even though I just "requested" the token.

And if I do this:

#!/bin/sh

repository="2xxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/nexus-pro"
tag="2.13.0-np-1.0"

ecr_token=$(aws ecr get-login | awk '{print ($6)}')

docker_login=$(echo "{\"username\":\"AWS\",\"password\":\"${ecr_token}\", \"auth\":\"\",\"email\":\"none\"}" | base64)

curl -X POST -d "" -H "X-Registry-Auth: ${docker_login}" http://${ip_address}:4243/images/create?fromImage=${repository}&tag=${tag_source}

I get the following error:

$ error parsing HTTP 404 response body: invalid character 'p' after top-level value: "404 page not found\n"

The image is on ECR and I can pull it if I do the docker login ... and then docker pull 2xxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/nexus-pro:2.13.0-np-1.0

I'm not sure what I'm doing wrong here.. Any help is very much appreciated!

Piyush Patil · Accepted Answer · 2016-07-08 14:57:16Z

2

Basic authentication is only supported over HTTPS. The docker client will not send basic auth headers when pushing/pulling on a registry over HTTP. This is done by design to prevent people sending their credentials over insecure channels. Using SSL should get rid of the issue.

Try using below:

https://${ip_address}:4243/images/create?fromImage=${repository}&tag=${tag_source}

Or enable a SSL certificate for the instance from where you are pulling the image. Tis might help you. http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-an-instance.html

edited Jul 8, 2016 at 14:57

answered Jul 8, 2016 at 14:27

Piyush Patil

14.6k8 gold badges45 silver badges59 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Fadi Over a year ago

Hmm, I'm getting this error now: curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Piyush Patil Over a year ago

Use this registry.hub.docker.com instead of https://${ip_address}

Fadi Over a year ago

The ${ip_address} is the instance that has Docker Engine installed.. It's not the registry..

Piyush Patil Over a year ago

Ok then you have to get a SSL certificate for that instance because the basic authentication works only for Https. This might help you docs.aws.amazon.com/AWSEC2/latest/UserGuide/…

Fadi Over a year ago

Are you sure because according to this post: stackoverflow.com/questions/24814714/… the person has done it without https

|

Collectives™ on Stack Overflow

Pull docker image from AWS ECR using remote API

1 Answer 1

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related