{"id":13647264,"url":"https://github.com/monken/aws-ecr-public","last_synced_at":"2025-04-13T02:32:03.599Z","repository":{"id":55917066,"uuid":"177314272","full_name":"monken/aws-ecr-public","owner":"monken","description":"Public endpoint for AWS Elastic Container Registry","archived":false,"fork":false,"pushed_at":"2020-12-07T13:26:50.000Z","size":53,"stargazers_count":145,"open_issues_count":3,"forks_count":28,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-26T20:21:22.071Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/monken.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"github":"monken"}},"created_at":"2019-03-23T16:41:58.000Z","updated_at":"2025-03-14T17:04:03.000Z","dependencies_parsed_at":"2022-08-15T09:20:47.329Z","dependency_job_id":null,"html_url":"https://github.com/monken/aws-ecr-public","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monken%2Faws-ecr-public","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monken%2Faws-ecr-public/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monken%2Faws-ecr-public/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monken%2Faws-ecr-public/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/monken","download_url":"https://codeload.github.com/monken/aws-ecr-public/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248657793,"owners_count":21140842,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:03:26.820Z","updated_at":"2025-04-13T02:32:03.326Z","avatar_url":"https://github.com/monken.png","language":"JavaScript","funding_links":["https://github.com/sponsors/monken"],"categories":["Docker","JavaScript"],"sub_categories":["Observability"],"readme":"# Public AWS Elastic Container Registry\n\nHost any Elastic Container Registry (ECR) publicly on a custom domain using this serverless proxy.\n\nGive it a spin:\n\n```bash\n# pull a container from a registry named nginx with no authentication\ndocker pull v3iomfy255.execute-api.us-east-2.amazonaws.com/nginx:alpine\n```\n\n## Solution Overview\n\nECR doesn't support [public registries](https://aws.amazon.com/ecr/faqs/). Instead, the docker client needs to authenticate with ECR using AWS IAM credentials which requires the AWS CLI or an SDK that can generate those credentials.\n\nIf you would like to make your registries publicly available then this solution can help. It deploys an API Gateway and a Lambda function that act as a proxy for AWS ECR. [Custom authentication](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html) can easily be added in the API Gateway. Roll your own JWT-based authentication or whatever you desire. Additionally, you can configure the [API Gateway to be private](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html) and thus limit access to docker clients within your VPC.\n\n![diagram](docs/aws-ecr-public.svg)\n\n## Deploy\n\n[![launch](docs/launch-stack.svg)](https://console.aws.amazon.com/cloudformation/home?#/stacks/create/review?filter=active\u0026templateURL=https%3A%2F%2Fs3.us-east-2.amazonaws.com%2Fmonken%2Faws-ecr-public%2Fv1.2.0%2Ftemplate.json\u0026stackName=ecr-public)\n\n[Download Template](https://s3.us-east-2.amazonaws.com/monken/aws-ecr-public/v1.2.0/template.json)\n\n\n### Template Parameters\n\n| Parameter | Required | Description |\n| -- | -- | -- |\n| DomainName | No | If provided an ACM Certificate and API Domain Name will be created\n| ValidationDomain | No | Overwrite default Validation Domain for ACM Certificate\n| ValidationMethod | Yes, default to `EMAIL` | Allow you to use `DNS` instead of `EMAIL` for Certificate validation\n| Authorizer | No, defaults to `NONE` | Valid values are `NONE`, `BASIC`, `AZURE_DEVOPS` or `CUSTOM`\n| AuthBasicUsername | If Authorizer is `BASIC` | Username for Basic authentication\n| AuthBasicPassword | If Authorizer is `BASIC` | Password for Basic authentication\n| AuthAzureDevOpsOrg | If Authorizer is `AZURE_DEVOPS` | Organization name in Azure Devops\n| AuthCustomLambdaArn | If Authorizer is `CUSTOM` | ARN of your custom Lambda authorizer\n\n## Authorizers\n\nThis template ships with support for Basic authentication, Azure Devops (using system or access token) and custom Lambda.\n\nAzure DevOps Pipeline example:\n\n```yaml\n# username must be ADO\nsteps:\n- script: |\n    echo $TOKEN | docker login --username ADO --password-stdin example.execute-api.us-east-2.amazonaws.com\n    docker pull example.execute-api.us-east-2.amazonaws.com/nginx:latest\n  env:\n    TOKEN: $(System.AccessToken)\n```\n\n## FAQ\n\n### How can I host this proxy on a custom domain?\n\nSimply provide the `DomainName` parameter when you create the stack. This will create an ACM certificate and API Domain Name resource. The Regional Domain Name and Hosted Zone ID can be found in the outputs tab of the stack. You will need those to create the DNS record in Route 53 (or similar DNS service).\n\nFor Route 53, open your hosted zone, create a **New Record Set**, enter the domain name, set **Alias** to **Yes** and paste the `RegionalDomainName` in the **Alias Target** field.\n\n### How can I restrict access to certain registries?\n\nBy default all registries in the account and region will be made publicly available. To limit the number of publicly available repositores, attach a custom policy to the Lambda execution role (look for `${AWS::StackName}-LambdaRole-*`). The following policy will restrict public access to the `myapp` repository (make sure you replace the variables with your region and account id).\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Action\": [\n                \"ecr:GetDownloadUrlForLayer\",\n                \"ecr:BatchGetImage\"\n            ],\n            \"NotResource\": [\n                \"arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/myapp\"\n            ],\n            \"Effect\": \"Deny\"\n        }\n    ]\n}\n```\n\n## Develop\n\n```\nnpm install --global cfn-include\nmake build\nmake test  # create/update CloudFormation stack\nmake clean # delete CloudFormation stack\n```\n\n## In the works\n\n* Cross-account and cross-region access to registries\n* Tag-based permissions\n* Implement additional endpoints for listing images and tags\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonken%2Faws-ecr-public","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmonken%2Faws-ecr-public","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonken%2Faws-ecr-public/lists"}