docker pushUpload an image to a registry
docker push uploads a local image to the registry named in its tag (Docker Hub, ECR, GHCR...). Only layers the registry doesn't already have are sent. You tag the image with the registry's address first, and log in with docker login.
docker push [OPTIONS] [REGISTRY/]NAME[:TAG]CI built shop-api:1.4.0 and you need it in ECR so ECS can pull it.
docker pushUpload the image's layers and manifest to the registry that the image name points at.
push reads the registry host from the image name, so a name without one goes to Docker Hub. dockerd gets a token with push scope (from your docker login credentials or a credential helper). For each layer it asks HEAD /v2/<repo>/blobs/<digest>: if the registry already has it (in this repository, or mountable from another one) it prints Layer already exists. Missing layers are uploaded with POST to start an upload session, PATCH or PUT with the compressed bytes, and a final PUT with the digest the registry verifies. Then the config blob, and last the manifest via PUT /v2/<repo>/manifests/<tag>. Writing the manifest is what makes the tag visible, so a failed push never leaves a half-image under that tag. The registry replies with the manifest's digest.
-a, --all-tagsPush every local tag of the repository-q, --quietSuppress per-layer progress--platform OS/ARCHPush only one platform's variant of a multi-platform imagedocker tag SRC DESTGive the image the registry name to push to (companion command)docker login REGISTRYStore credentials for a registry; --password-stdin reads them from a pipedocker buildx build --pushBuild and push in one go, including multi-platform imagesdocker login -u AWS -p $(aws ecr get-login-password) ...The token ends up in the process list and shell history.
aws ecr get-login-password | docker login --username AWS --password-stdin <registry>Re-pushing a fixed build under the same tag, like 1.4.0 or latestHosts that already pulled the tag keep the old image, and you can no longer say what 1.4.0 means.
Push a new tag (1.4.1 or the git SHA) and enable tag immutabilityPushing an image built on an M-series Mac straight to an x86 clusterIt's linux/arm64, and the nodes fail with 'exec format error'.
docker buildx build --platform linux/amd64,linux/arm64 -t <repo>:1.4.0 --push .Try these on a Linux machine of your own. Each task has a hint and a solution.
Give local image shop-api:1.4.0 the ECR name 123456789012.dkr.ecr.us-east-1.amazonaws.com/shop-api:1.4.0 and try to push it. Which error do you get, and what is missing?
Write the ECR login command that never puts the token on the command line.
Do it for real: in the CrackOps AWS Lab, create an ECR repository, push an image, and use its digest in an ECS task definition.
docker pushUpload an image to a registry
docker push uploads a local image to the registry named in its tag (Docker Hub, ECR, GHCR...). Only layers the registry doesn't already have are sent. You tag the image with the registry's address first, and log in with docker login.
docker push [OPTIONS] [REGISTRY/]NAME[:TAG]CI built shop-api:1.4.0 and you need it in ECR so ECS can pull it.
docker pushUpload the image's layers and manifest to the registry that the image name points at.
push reads the registry host from the image name, so a name without one goes to Docker Hub. dockerd gets a token with push scope (from your docker login credentials or a credential helper). For each layer it asks HEAD /v2/<repo>/blobs/<digest>: if the registry already has it (in this repository, or mountable from another one) it prints Layer already exists. Missing layers are uploaded with POST to start an upload session, PATCH or PUT with the compressed bytes, and a final PUT with the digest the registry verifies. Then the config blob, and last the manifest via PUT /v2/<repo>/manifests/<tag>. Writing the manifest is what makes the tag visible, so a failed push never leaves a half-image under that tag. The registry replies with the manifest's digest.
-a, --all-tagsPush every local tag of the repository-q, --quietSuppress per-layer progress--platform OS/ARCHPush only one platform's variant of a multi-platform imagedocker tag SRC DESTGive the image the registry name to push to (companion command)docker login REGISTRYStore credentials for a registry; --password-stdin reads them from a pipedocker buildx build --pushBuild and push in one go, including multi-platform imagesdocker login -u AWS -p $(aws ecr get-login-password) ...The token ends up in the process list and shell history.
aws ecr get-login-password | docker login --username AWS --password-stdin <registry>Re-pushing a fixed build under the same tag, like 1.4.0 or latestHosts that already pulled the tag keep the old image, and you can no longer say what 1.4.0 means.
Push a new tag (1.4.1 or the git SHA) and enable tag immutabilityPushing an image built on an M-series Mac straight to an x86 clusterIt's linux/arm64, and the nodes fail with 'exec format error'.
docker buildx build --platform linux/amd64,linux/arm64 -t <repo>:1.4.0 --push .Try these on a Linux machine of your own. Each task has a hint and a solution.
Give local image shop-api:1.4.0 the ECR name 123456789012.dkr.ecr.us-east-1.amazonaws.com/shop-api:1.4.0 and try to push it. Which error do you get, and what is missing?
Write the ECR login command that never puts the token on the command line.
Do it for real: in the CrackOps AWS Lab, create an ECR repository, push an image, and use its digest in an ECS task definition.