Can't pull a docker image from a private ECR repository inside an EC2 instance

Question

I'm currently running an EC2 instance inside a vpc v2 environment. Inside the EC2 instance I'm trying to execute a docker pull command from a private repository on ECR. Doing a docker pull command gives an error: `permission denied while trying to connect to the Docker daemon socket`. When running with the sudo command it gives another error: `Error response from daemon: Head ....: no basic auth credentials`.

Before I do a pull I first login succesfully with the docker client: `aws ecr get-login-password --region  | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com`

The aws-cli command has access to the ECR repository. When using the `aws ecr describe-repositories --repository-names` command, it returns details about the repository.

To the EC2 instance profile role I've added the policy `AmazonEC2ContainerRegistryReadOnly` to be able to read the repository on ECR. That didn't work. I removed this policy and added the `AmazonEC2ContainerRegistryFullAccess` policy, also without success.

When running `docker login` or `sudo docker login` the result doesn't show registry information. It appears the docker client isn't authenticated to read the ecr repository.

Do I need to update the policy or something else to be able to pull a docker image?

rePost-User-9005310 · Accepted Answer

The solution was to update the command to authenticate the docker client with sudo.
Before I used: 
`aws ecr get-login-password --region  | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com`

After I used sudo:
`aws ecr get-login-password --region  | sudo docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com`

After this, I was able to pull the docker image from ecr.

Didier Durand · Answer

Hi,

Look on this page for all details: https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html

This is a sample policy allowing to pull images that is provided. You want to check your current existing ECR-related policies to see if you grant same auths `ecr:BatchGetImage` and `ecr:GetDownloadUrlForLayer`

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPull",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::account-id:user/pull-user-1",
                    "arn:aws:iam::account-id:user/pull-user-2"
                ]
            },
            "Action": [
                "ecr:BatchGetImage",
                "ecr:GetDownloadUrlForLayer"
            ]
        },
        {
            "Sid": "AllowAll",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account-id:user/admin-user"
            },
            "Action": [
                "ecr:*"
            ]
        }
    ]
}
```

Best,

Didier

Olawale Olaleye · Answer

Hello there,

Take a glance at the logs `cat ~/.ecr/log/ecr-login.log` to get more insight into what's going on.

You can refer to this documentations:

**no basic auth credentials from the docker push or docker pull commands** - https://docs.aws.amazon.com/AmazonECR/latest/userguide/common-errors-docker.html#error-403

Can't pull a docker image from a private ECR repository inside an EC2 instance

Add your answer

Relevant content