aws-ecr-http-proxy

A very simple nginx push/pull proxy that forwards requests to AWS ECR and caches the responses locally.

Configuration:

The proxy is packaged in a docker container and can be configured with following environment variables:

Environment Variable	Description	Status	Default
`AWS_REGION`	AWS Region for AWS ECR	Required
`AWS_ACCESS_KEY_ID`	AWS Account Access Key ID	Optional
`AWS_SECRET_ACCESS_KEY`	AWS Account Secret Access Key	Optional
`AWS_USE_EC2_ROLE_FOR_AUTH`	Set this to true if we do want to use aws roles for authentication instead of providing the secret and access keys explicitly	Optional
`UPSTREAM`	URL for AWS ECR	Required
`RESOLVER`	DNS server to be used by proxy	Required
`PORT`	Port on which proxy listens	Required
`CACHE_MAX_SIZE`	Maximum size for cache volume	Optional	`75g`
`CACHE_KEY`	Cache key used for the content by nginx	Optional	`$uri`
`ENABLE_SSL`	Used to enable SSL/TLS for proxy	Optional	`false`
`REGISTRY_HTTP_TLS_KEY`	Path to TLS key in the container	Required with TLS
`REGISTRY_HTTP_TLS_CERTIFICATE`	Path to TLS cert in the container	Required with TLS

Example:

docker run -d --name docker-registry-proxy --net=host \
  -v /registry/local-storage/cache:/cache \
  -v /registry/certificate.pem:/opt/ssl/certificate.pem \
  -v /registry/key.pem:/opt/ssl/key.pem \
  -e PORT=5000 \
  -e RESOLVER=8.8.8.8 \
  -e UPSTREAM=https://XXXXXXXXXX.dkr.ecr.eu-central-1.amazonaws.com \
  -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
  -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
  -e AWS_REGION=${AWS_DEFAULT_REGION} \
  -e CACHE_MAX_SIZE=100g \
  -e ENABLE_SSL=true \
  -e REGISTRY_HTTP_TLS_KEY=/opt/ssl/key.pem \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/opt/ssl/certificate.pem \
  esailors/aws-ecr-http-proxy:latest

If you ran this command on "registry-proxy.example.com" you can now get your images using docker pull registry-proxy.example.com:5000/repo/image.

Deploying the proxy

Deploying with ansible

Modify the ansible role variables according to your need and run the playbook as follow:

ansible-playbook -i hosts playbook-docker-registry-proxy.yaml

In case you want to enable SSL/TLS please replace the SSL certificates with the valid ones in roles/docker-registry-proxy/files/*.pem

Deploying on Kubernetes with Helm

You can install on Kubernetes using the community-maintained chart like this:

helm repo add evryfs-oss https://evryfs.github.io/helm-charts/
helm install evryfs-oss/ecr-proxy --name ecr-proxy --namespace ecr-proxy

See the values-file for configuration parameters.

Note on SSL/TLS

The proxy is using HTTP (plain text) as default protocol for now. So in order to avoid docker client complaining either:

(Recommended) Enable SSL/TLS using ENABLE_SSL configuration. For that you will have to mount your valid certificate/key in the container and pass the paths using REGISTRY_HTTP_TLS_* variables.
Mark the registry host as insecure in your client deamon config.