# Amazon ECR

> A private warehouse on AWS for your container images, ready to be deployed.

- Level: Intermediate
- Topics: AWS
- URL: https://tidbit.legios.com.ar/amazon-ecr/
- In Spanish: [Amazon ECR](https://tidbit.legios.com.ar/es/amazon-ecr/)

**ECR** (Elastic Container Registry) is where you store container images on AWS. An image is the packaged version of an app: the code, the libraries and the settings it needs, frozen in one file that any machine can run. Before you can run it on AWS, the image has to live somewhere AWS can fetch it from, and that place is a **container registry**.

The flow is short. A developer or a build pipeline creates the image with Docker, tags it with a version like `web:1.4.2`, and **pushes** it to an ECR repository. Then Amazon ECS, Amazon EKS or AWS Lambda **pulls** that exact version and starts it. Access is controlled with IAM, so only the people and services you allow can push or pull.

ECR also does some housekeeping: it can scan images for known vulnerabilities in the software they contain, and lifecycle rules can delete old versions automatically so the repository does not grow forever. There is a public side too, for sharing images with anyone, but most teams use ECR as the private, nearby copy of what they deploy.

## An analogy

The loading dock of a factory. Finished, sealed boxes (images) wait on labeled shelves, and the delivery trucks (ECS, EKS, Lambda) pick up exactly the box with the label they were told to take.

## Keep in mind

- Stores and versions container images inside your AWS account.
- You push images to it; ECS, EKS and Lambda pull them to run.
- Access goes through IAM; images are private by default.
- Can scan images for known vulnerabilities and expire old versions.

## Go deeper

- [What is Amazon ECR? (official docs)](https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html)
- [Amazon ECR](https://aws.amazon.com/ecr/)

## Related terms

- [Container](https://tidbit.legios.com.ar/container/): A sealed box with a program and everything it needs to run anywhere.
- [Docker](https://tidbit.legios.com.ar/docker/): The tool that made containers easy: package an app once, run it anywhere.
- [Amazon ECS and Fargate](https://tidbit.legios.com.ar/amazon-ecs-and-fargate/): AWS runs your containers; with Fargate you never see the servers at all.
- [Amazon EKS](https://tidbit.legios.com.ar/amazon-eks/): Kubernetes with the hard part, the control plane, run by AWS.
- [AWS Lambda](https://tidbit.legios.com.ar/aws-lambda/): Run a piece of code only when something happens, with no server to manage.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.
- [Vulnerability and CVE](https://tidbit.legios.com.ar/vulnerability-and-cve/): A flaw that lets an attacker misuse software, and the public id that names it.
- [AWS account and billing](https://tidbit.legios.com.ar/aws-account-and-billing/): What an AWS account is, how you get charged, and how to avoid a surprise bill.