Why can’t I do unauthenticated pull from public ECR?

Question

I have a public ECR and a couple of Docker images there. I am trying to run “docker pull” without being authenticated (no ~/.docker/config.json exists) but I am asked to login prior to pull.
How can it be fixed because I do not need authentication.

*“
[root@pr16c6 ~]# cat ~/.docker/config.json
cat: /root/.docker/config.json: No such file or directory

[root@pr16c6 ~]# docker pull public.ecr.aws/unitrends/repqueuer:10.7.11-1
Pulling repository public.ecr.aws/unitrends/repqueuer

Please login prior to pull:
Username:
"*

Didier Durand · Answer

Hi,

You can create fully public ECR repositories: see https://docs.aws.amazon.com/AmazonECR/latest/public/public-repository-policies.html

But, be extremely careful: such repos get publicly visible on the Amazon ECR Public Gallery and anyone can pull images from the repository. That potentially means costs that you will incur to pay for corresponding trafic.

So, unless your purpose it to really have a public ECR with lots of visitors, I 'd suggest to use the approach suggested by Riku in his answer of this thread.

Best,

Didier

Riku_Kobayashi · Answer

Hello.

I think the command will be successful if you run the following command and then "docker pull".  
https://docs.aws.amazon.com/ja_jp/AmazonECR/latest/public/public-registry-auth.html  
> The Docker CLI does not support native IAM authentication methods. Additional steps must be taken so that Amazon ECR can authenticate and authorize Docker push and pull requests.  
```
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
```

Mohammed sayeeduddin · Answer

Hi, 
If you’re trying to pull an image from a public Amazon ECR repository, you should be able to do so without authentication, provided the repository is set to public.

Please clear the cache and try it

docker system prune -a

Why can’t I do unauthenticated pull from public ECR?

Add your answer

Relevant content