Questions[amazon-ecr](server)

I'm working on porting a collection of Docker images used for GitLab CI/CD building and deployment from Dockerhub to AWS public ECR. Everything works as it should except for the standard Docker image that we use as a Docker-in-Docker service. The same exact image that works when pulled from Dockerhub fails to login when pulled from public ECR.

.gitlab-ci.yml

    build-push:
      stage: package
      image: public.ecr.aws/x/x
      services:
      - public.ecr.aws/x/docker-dind:20.10

$ aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_DOCKER_REGISTRY_URL
> Logging in to Docker registry...
> error during connect: Post http://docker:2375/v1.24/auth: dial tcp: lookup docker on 8.8.8.8:53: no such host

$ cat /etc/hosts
127.0.0.1   localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2  public.ecr.aws__*
172.17.0.2  public.ecr.aws-*
172.17.0.3  runner-*

Thank you.

Background: I've worked with EC2 and RDS. Recently I received a query from a client in which he wants to develop both mobile and web applications using Amazon Web Services, and need advice on which service he should go with?

• Elastic Beanstalk
• Lambda
• Elastic Container Service (ECS) or Elastic Container Registry (ECR)

Also, I've gone through several tutorials on YouTube and Google to understand these services, but still I'm unable to figure out with which service he should go with.

Problem: I don't have any proper knowledge and experience working with the above mentioned services. Therefore, I want advice from the people who have experience working with them.

Please explain with advantages and disadvantages of using specific service so it will be easier for me to advice.

Currently, I have this command in my bash script for building & pushing an image to Amazon ECR

docker login -u AWS -p "$(aws ecr get-login-password)" "https://$(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.us-east-1.amazonaws.com"

Which gives the warning "WARNING! Using --password via the CLI is insecure. Use --password-stdin."

How can I change this command to not give the warning? Is this really insecure?

I'm trying to esimate monthly cost of using AWS ECR. It will consist of: outgoing traffic cost (downloading images) and storage cost (storing images in ECR).

Let's assume, that:

• We are building some web service using Mono (base docker image size is 500Mb);
• Our CI&CD server builds and pushes images to ECR 300 times per month. Old images not removed for simplicity;
• Our compiled code adds additional layer of 40Mb to base image;
• We download images 60 times per month from AWS;

The 1st question is: how to estimage monthly storage volume? What equation is correct?

Monthly_Vol_1 = 500+40*300; - base image stored only once

Monthly_Vol_2 = (500+40)*300; - every image includes base image

The 2nd questions is: how to estimate monthly traffic from AWS? Let's assume, that host downloading images does not remove existing data.

Monthly_Traf_1 = (500+40)*60; - every time it downloads base image and additional layer

Monthly_Traf_2 = 500+40*60; - base image is downloaded only for the 1st image. Only application updates are downloaded

Monthly_Traf_3 = 40*60; - base image is downloaded not from AWS ECR, but from docker hub

UPDATE:

I uploaded 2 images to AWS ECR in September and checked billing info after 2 months. What I discovered:

It cost me $0.04 monthly just to store 2 images (without transfers). According to AWS ECR pricing ($0.10 per 1Gb storage) looks like Amazon stores 400Mb of data. The same 400Mb I see in AWS ECS dashboard.

I tried to understand and calculate what data is stored (using docker image and docker history commands), but failed.

I have 2 docker images uploaded to AWS ECR:

1. SVC (482Mb) based on Mono (409Mb)
2. WEB (679Mb) based on Node (634Mb)

If AWS stores full images, then it shall store 482+679=1161Mb

If AWS stores just added layers, then it shall store 45+73=118Mb

How AWS calculates 400Mb? O_o

UPDATE2:

Looks like AWS stores full images, but compressed (400Mb instead of 1161Mb). According to http://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImages.html

Beginning with Docker version 1.9, the Docker client compresses image layers before pushing them to a V2 Docker registry. The output of the docker images command shows the uncompressed image size, so it may return a larger image size than the image sizes returned by DescribeImages.

We're using AWS ECR to host our docker images. We've noticed in a few rare instances that the docker push command can complete successfully, but the resulting image does not appear in the ECR container repository.

Any others experiencing this issue? Our ECR is in us-east-1

Output from our docker push script:

WARNING: login credentials saved in /home/ubuntu/.docker/config.json
Login Succeeded
The push refers to a repository [<our-id>.dkr.ecr.us-east-1.amazonaws.com/<our-repo>] (len: 2)
...
develop: digest: sha256:<redacted-sha> size: 36365
develop.<redacted-tag>: digest: sha256:<redacted-sha> size: 36370