Locally, I use Podman to run "Docker" images. Mostly, I do this for local testing: either simulating what a remote CI pipeline would do or validating that an image I intend to use for remote CI pipelines are ready for that task. Being the paranoid type, I've also started using it to run AI agents inside of containers.
Recently, I was assigned to a project that is using ECR as their container-registry. Some of the things they store in their container-registry are the images they use in the CI pipelines. As such, I needed (wanted) to figure out, "how do I pull their CI images out of their registry so I can use them for pre-commit validation via Podman". At any rate, I came up with a list of relevant tasks. Some are purely AWS-level tasks. Some are purely Podman-level tasks. Some combine the two.
AWS-only Tasks
Determine Account ID
Given the number of projects I work on and that most of those projects require me to access a bunch of accounts, it helps to know which account I'm dealing with and, for some tasks, the numerical account-ID. When interacting with ECr, knowing the numerical account-ID is a requirement. As such, it's good to know how to retrieve that value. When using AWS's SSO service to login to accounts, one such way is:
aws configure get sso_account_id --profile >PROFILE_NAME>
This will spit out the 12-digit account-id of the targeted account.
Get Tabular-Lisf ECR Repositories Within Account
Any given ECR-enabled AWS account can have multiple image-repositories within it. If someone hasn't told you which one you need to be interacting with, you can help yourself by checking to see which repositories are available within the account's ECR setup using something similar to:
aws --profile <PROFILE_NAME> \ ecr describe-repositories \ --registry-id <REGISTRY_ID> \ --query "repositories[*].repositoryName" \ --output table
I tend to prefer tabular output for tasks like this. If you prefer a different output-format, change the value for the --output argument. You can also wholly omit it if you're fine with the default output-format
Get Tabular, Targeted-List of Registry-Images
I generally know which image-names I'm interested …Or, at least, what substring those images start with. I use something like the following to show me those images
aws --profile <PROFILE_NAME> \
ecr describe-images \
--registry-id <REGISTRY_ID> \
--repository-name <ECR_REPOSITORY_NAME> \
--filter tagStatus=TAGGED \
--query "sort_by(imageDetails[?imageTags[?starts_with(@, '<PREFIX_STRING>')]], &imagePushedAt)[*].{ImageTag: imageTags[?starts_with(@, '<PREFIX_STRING>')] | [0], PushedAt: imagePushedAt}" \
--output tableThis ensures that the table is sorted, oldest first, by image-creation time. See the following example:
--------------------------------------------------------------------------- | DescribeImages | +------------------------------------+------------------------------------+ | ImageTag | PushedAt | +------------------------------------+------------------------------------+ | <CI_CONTAINER_NAME>_1.7.5 | 2024-12-10T14:34:13.211000-05:00 | | <CI_CONTAINER_NAME>_1.9.8 | 2025-01-07T12:47:07.506000-05:00 | | <CI_CONTAINER_NAME>_1.9.8 | 2025-03-25T14:40:25.032000-04:00 | | <CI_CONTAINER_NAME>_1.11.4 | 2025-04-23T12:02:03.739000-04:00 | | <CI_CONTAINER_NAME>_1.11.3 | 2025-04-24T13:04:36.974000-04:00 | | <CI_CONTAINER_NAME>_1.14.8 | 2026-04-01T15:59:57.931000-04:00 | | <CI_CONTAINER_NAME>_1.15.0 | 2026-07-12T07:32:07.134000-04:00 | +------------------------------------+------------------------------------+
Giving Podman Access to ECR
Once I have identified the image(s) I wish to work with, via podman, it's necessary to grant Podman access to the ECR registry. This requires extracting a (temporary) login password-string from ECR and piping it into Podman. This can be done like so:
aws --profile <PROFILE_NAME> \ ecr get-login-password \ --region <AWS_REGION> | \ podman login \ --username AWS \ --password-stdin <AWS_ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com
Podman-only Tasks
Get list of image-paths and associated tags
If you don't know which images or associated tags to target, you can issue a command like:
podman search \ --list-tags \ --limit 100 \ <ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/<IMAGE_PATH>
Which will produce output like the following:
NAME TAG <ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/<REGISTRY_PATH> <IMAGE_TAG_1> <ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/<REGISTRY_PATH> <IMAGE_TAG_2> […ELIDED…] <ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/<REGISTRY_PATH> <IMAGE_TAG_N>
Pull desired (tagged) image
Pulling (or running) an image is then like any other Podman pull/run task (for example):
podman run \ -it \ --rm \ --entrypoint /bin/bash \ <AWS_ACCOUNT_ID>.dkr.ecr.<AWS_REGION>.amazonaws.com/<IMAGE_PATH>:<IMAGE_TAG>
