Using AWS EC2 Container Registry to host Docker images for deployment with Elastic Beanstalk

Amazon’s EC2 Container Registry (ECR) was just launched, with general availability today. Access to ECR is controlled via AWS Identity and Access Management (IAM). ECR integrates with EC2 Container Service (ECS), but as of yet, there doesn’t seem to be an integration with AWS Elastic Beanstalk.

Elastic Beanstalk (EB) is a service that automates infrastructure provisioning and application deployment for web applications. It supports two ways of deploying Dockerized applications: by locally building the Docker image from a Dockerfile on each Elastic Beanstalk instance, or by pulling a pre-built image from a Docker registry. The latter generally provides faster instance and application startup times since Elastic Beanstalk only needs to pull an existing image.

I wanted to share one way to use ECR to host images for your single-container Docker applications on Elastic Beanstalk.

Note: I assume that you already have a single-container Docker application deployed to Elastic Beanstalk and are pulling the image from a public or private Docker registry.

• Create an ECR repository my-repository. ECR is currently only available in us-east-1, so we use that region in the instructions below.
• Follow the ECR documentation on how to build and push your Docker image to the registry.
• Make sure your Elastic Beanstalk environment has an EC2 instance profile configured. Attach the following policy to the corresponding IAM role. This allows your Beanstalk instances to get a Docker authentication token for the registry and to pull images from it. Substitute YOUR_AWS_ACCOUNT_ID with you actual numeric AWS account ID (the same number you see in the beginning of your ECR repository URL).

• Update (14.01.2016): This step is no longer required. AWS Elastic Beanstalk now supports integration with ECR when you upgrade your solution stack to ‘64bit Amazon Linux 2015.09 v2.0.6 running Docker 1.7.1’ or later. See the Elastic Beanstalk documentation for details.
  The single container Docker AMI for Elastic Beanstalk currently comes with AWS CLI 1.9.1, which does not support ECR. We need to install a newer version on the EB instances using an .ebextensions configuration. To do that, add a file named ecr.config with the following content to your .ebextensions directory (see the AWS documentation for more details). ECR login tokens are valid for 12 hours so we get a fresh one each time the application is deployed.

• Update your Dockerrun.aws.json configuration file to point to your ECR registry. Replace YOUR_AWS_ACCOUNT_ID with your numeric account ID. Naturally, you can also specify another image tag than latest. (See the documentation for more details.)

That’s it! You can now deploy your app to Elastic Beanstalk and your app’s Docker image will be pulled from ECR.

- Boyan