Publish images on Amazon ECR public registry

[siwyd]

With the Amazon ECR public registry live, it would be nice to have the images published there: https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-ecr-public-and-amazon-ecr-public-gallery/

[davecurrie]

Thanks for getting in touch. We are planning to do that, stay tuned.

[jwalsh2me]

That would be so much nicer than Docker Hub or the current shared ECR repo. Thank you @davecurrie

[JohnPreston]

I can't agree more with @jwalsh2me .
Whilst reaching to the different AWS teams here is on top of my head another few images I would expect to find in there:

• AWS AmazonLinux (https://gallery.ecr.aws/amazonlinux/amazonlinux)
• AWS Corretto8/11/15
• AWS X-Ray
• AWS Codebuild images
• Envoy (for AppMesh) (https://gallery.ecr.aws/appmesh/aws-appmesh-envoy)
• AWS CLI (https://gallery.ecr.aws/bitnami/aws-cli)

EDIT : Sorry I know this is corretto space but I am an all-in AWS user so if you could please let your peers know 🥇
EDIT 2 : added the ones I found in the gallery

[jwalsh2me]

@davecurrie Any estimate on when the images might be showing up in the Public ECR? I see some AWS stuff starting to show up there like AmazonLinux and the ECS agent etc.

[davecurrie]

It won't be too long.

[cynicaljoy]

what's the definition of "too long"? 🤔

[ziyiluo]

The Corretto team is currently preparing the January 2021 critical patch update. We just finished itemizing the tasks for the public ECR support. This will be our primary post-release project.

[jwalsh2me]

Thank you for the update @ziyiluo !

[jwalsh2me]

@ziyiluo Been a while, any update? I am hitting Docker Rate limits now pulling Coretto11 from Docker Hub.

[davecurrie]

Note that we do provide an ECR repository to pull from without limits -- see the "Using Corretto ECR Instance" at https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/docker-install.html.

Moving to the ECR public gallery is something we plan to do but in the meantime you should be able to work around limits using the instructions above.

[jwalsh2me]

Thanks @davecurrie I totally forgot about the ECR Images, got too excited about Public ECR! This will work.

[luketn]

Just added issue #51 related more generally to publishing the 'slim' JDK variants of the Corretto container images we recently added to the repo:
https://github.com/corretto/corretto-docker/tree/master/15/slim

Thought I would reference the issue here, as it would be awesome to see these slim images published into the Amazon ECR Public registry alongside the full JDK Corretto images.

The slim Corretto images are significantly smaller whilst still being functional JDKs. The build uses jlink to omit documentation, header and debug files. Other than that the whole JDK is there.
i.e.

jlink --add-modules "$(java --list-modules | sed -e 's/@[0-9].*$/,/' | tr -d \\n)" --no-man-pages --no-header-files --strip-debug --output /opt/corretto-jdk-slim

The size saved is significant in these slim variants hence I'd highly recommend including them in this effort:

Uncompressed:
Alpine Linux: 175 MB (183 MB smaller)
Amazon Linux 2: 357 MB (113 MB smaller)

Compressed:
Alpine Linux: 58 MB (140 MB smaller)
Amazon Linux 2: 123 MB (83 MB smaller)

If they are used it will wind up saving a huge amount of data transfer and result in great increases in startup performance too.

[vehvis]

Any news on this? It's June soon and doing the auth dance to the ECR repo is getting real old. :)

[jeblackmore]

They are there now:
https://gallery.ecr.aws/ews-network/amazoncorretto

[davecurrie]

Note that these images aren't provided by us -- they are in an organization called "ews-network" which we don't control. We will have an organization called "amazoncorretto" and it will be a verified account.

We recommend not using the images linked above since they are of unknown origin.

[jeblackmore]

Thanks @davecurrie, I hadn't realised third parties would be able to host images. I have no connection with the organization above and had just assumed these were the official images.

[JohnPreston]

ews-network is me ^^
Repo used to build the images through codebuild : https://github.com/EWS-Network/amazoncorretto-images
I maintain those for my official company and I have a private ECR epo to get scan reports etc.

Going the painful way to get the account verified ...
Looking forward to official ones

[uname223]

Hi there, @davecurrie we are now 7 months from the beginning of this thread, do you plan to publish images in ECR public registry anytime soon?

[davecurrie]

Yes, this is still something we plan to bring soon but I don't have a timeline to share yet.

[JohnPreston]

Very happy to see the images finally made it to ECR 🎉

[luketn]

@davecurrie Awesome that the builds are on the public ECR, but we're still missing the -slim variants. Any chance we can add those too?

[JohnPreston]

It would be great to have the builds in Public Codebuild too for auditing purposes, not that we do not have the Dockerfile of course, but just because it'd be nice to use AWS' own tooling :)
Also got a PR in prep coming your way to add a couple things.

[adrian-skybaker]

I've just tried switching to these, and the 16 image fails an ECR scan with 10 vulnerabilities, 7 of them critical:

None have been updated for two months:

[lutkerd]

JDK16 was a feature release and has reached end of life, we have no plans to patch the image since the JDK also has unpatched vulnerabilities. Please use JDK17 which is an LTS release.

[benty-amzn]

The images are now available in the public gallery https://gallery.ecr.aws/amazoncorretto/amazoncorretto

[luketn]

The images are now available in the public gallery https://gallery.ecr.aws/amazoncorretto/amazoncorretto

@benty-amzn would you also be able to include in the public gallery the missing '-slim' builds of Corretto? (#51)?