How to download or tag an untagged image on ECR?

Question

The UI on ECR does not let you apply tags to images. When you push images to ECR that have a tag that exists, the existing image becomes untagged, as expected. However, there does not appear to be a way to download untagged images. For example, I can't simply download the image hash

docker pull myarn.amazonaws.com/sandbox:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365
Error response from daemon: manifest for myarn.amazonaws.com/sandbox:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365 not found

Munich

Answer 1

So I discovered a user-unfriendly way of doing this. You first tag an untagged image, then you can download it. Here I tag an untagged image to backup

MANIFEST=$(aws ecr batch-get-image --repository-name sandbox --image-ids imageDigest=sha256:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365 --query 'images[].imageManifest' --output text)
aws ecr put-image --repository-name sandbox --image-tag backup --image-manifest "$MANIFEST"

Then I can download it as normal

docker pull myarn.amazonaws.com/sandbox:backup

Munich

One coment, region (--region) needs to be specified in both cases – Coeternity

If you configure your region in your aws config, you won't have to input region, see docs.aws.amazon.com/cli/latest/userguide/… – Munich

Very helpful response. this improves on the documentation written here for individuals that have untagged images docs.aws.amazon.com/AmazonECR/latest/userguide/image-retag.html – Schwa

Answer 2

You must use another notation that AWS suggests on its UI recently (it may not have been available that time):

docker pull myarn.amazonaws.com/sandbox@sha256:e226e9aaa12beb32bfe65c571cb60605b2de13338866bc832bba0e39f6819365

At least it did work with my untagged images.

Dissociate

It works really well to take a backup of untagged image. – Headlight

Answer 3

Assuming an ECR repository arn of 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:

To pull a docker image that is untagged, use the sha that you can copy from the ECR repository for your untagged image (Thanks to @Győző Papp' answer), eg:

docker pull 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository@sha256:bee1809b6ab2918yfdjsajhf21398f41cfc2dcc69d27253

To retag it once pulled, use docker tag with whatever tag you want, the below example tags it with the tag my-new-tag:

docker tag 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository@sha256:bee1809b6ab2918yfdjsajhf21398f41cfc2dcc69d27253 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:my-new-tag

Then push the tagged version back to AWS ECR:

docker push 1283761230897.dkr.ecr.us-east-1.amazonaws.com/my-repository:my-new-tag

You'll need to log in to ECR locally first using get-login first though...

Nuthouse