Public AWS Elastic Container Registry

Host any Elastic Container Registry (ECR) publicly on a custom domain using this serverless proxy.

Give it a spin:

# pull a container from a registry named nginx with no authentication
docker pull v3iomfy255.execute-api.us-east-2.amazonaws.com/nginx:alpine

Solution Overview

ECR doesn't support public registries. Instead, the docker client needs to authenticate with ECR using AWS IAM credentials which requires the AWS CLI or an SDK that can generate those credentials.

If you would like to make your registries publicly available then this solution can help. It deploys an API Gateway and a Lambda function that act as a proxy for AWS ECR. Custom authentication can easily be added in the API Gateway. Roll your own JWT-based authentication or whatever you desire. Additionally, you can configure the API Gateway to be private and thus limit access to docker clients within your VPC.

Deploy

Download Template

Template Parameters

Parameter	Required	Description
DomainName	No	If provided an ACM Certificate and API Domain Name will be created
ValidationDomain	No	Overwrite default Validation Domain for ACM Certificate
ValidationMethod	Yes, default to EMAIL	Allow you to use DNS instead of EMAIL for Certificate validation
Authorizer	No, defaults to NONE	Valid values are NONE, BASIC, AZURE_DEVOPS or CUSTOM
AuthBasicUsername	If Authorizer is BASIC	Username for Basic authentication
AuthBasicPassword	If Authorizer is BASIC	Password for Basic authentication
AuthAzureDevOpsOrg	If Authorizer is AZURE_DEVOPS	Organization name in Azure Devops
AuthCustomLambdaArn	If Authorizer is CUSTOM	ARN of your custom Lambda authorizer

Authorizers

This template ships with support for Basic authentication, Azure Devops (using system or access token) and custom Lambda.

Azure DevOps Pipeline example:

# username must be ADO
steps:
- script: |
    echo $TOKEN | docker login --username ADO --password-stdin example.execute-api.us-east-2.amazonaws.com
    docker pull example.execute-api.us-east-2.amazonaws.com/nginx:latest
  env:
    TOKEN: $(System.AccessToken)

FAQ

How can I host this proxy on a custom domain?

Simply provide the DomainName parameter when you create the stack. This will create an ACM certificate and API Domain Name resource. The Regional Domain Name and Hosted Zone ID can be found in the outputs tab of the stack. You will need those to create the DNS record in Route 53 (or similar DNS service).

For Route 53, open your hosted zone, create a New Record Set, enter the domain name, set Alias to Yes and paste the RegionalDomainName in the Alias Target field.

How can I restrict access to certain registries?

By default all registries in the account and region will be made publicly available. To limit the number of publicly available repositores, attach a custom policy to the Lambda execution role (look for ${AWS::StackName}-LambdaRole-*). The following policy will restrict public access to the myapp repository (make sure you replace the variables with your region and account id).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage"
            ],
            "NotResource": [
                "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/myapp"
            ],
            "Effect": "Deny"
        }
    ]
}

Develop

npm install --global cfn-include
make build
make test  # create/update CloudFormation stack
make clean # delete CloudFormation stack

In the works

• Cross-account and cross-region access to registries
• Tag-based permissions
• Implement additional endpoints for listing images and tags