Why private ECR can't support bootstrap container?

[yiuc]

Hi Team,

After reviewing the readme.md file, I came across a message regarding the bootstrap container. However, I have concerns that this feature may be challenging for many enterprise users due to security compliance restrictions, as they may rely on private ECR repositories in the AWS platform instead any another external image repo.

As a result, the current limitations of the bootstrap container could hinder their ability to utilize Bootlerocket.

I would like to inquire if there are any workarounds and future plans in place to support private ECR repositories, which would be valuable for enterprise users facing internet connectivity restrictions.

For host-container and bootstrap-container images from Amazon ECR private repositories, registry mirrors are currently unsupported.

[etungsten]

Hi @yiuc, sorry for the late response here.

To clarify, host-containers and bootstrap-containers do support private ECR repos. The limitation is with the settings.container-registry.mirrors setting that lets you configure mirror for container images pulls. Container images from private ECR repos can only be pulled directly, but cannot be pulled through a registry mirror. So unless you are relying on container registry mirrors, using images from private ECR for host-containers and bootstrap-containers should work fine. Lemme know if that answers your question.

[vchepkov]

@etungsten , I found this post, since I stumbled on the same issue. If I reference an artifactory source, bootstrap container works as expected, but if I replace it with an ECR source, it fails. Do I use a wrong uri, perhaps ?
my source looks like this

"1234567890.dkr.ecr.us-east-1.amazonaws.com/image:latest"

What I see in the journalctl

error="failed to resolve reference \"ecr.aws/arn:aws:ecr:us-east-1:1234567890:repository/image:latest\": invalid reference"

so my source is getting rewritten into something that doesn't work.

Please advice. Thank you

[yeazelm]

Hello @vchepkov, the source should be something like this:

[settings.boot-containers.my-container]
mode = "once"
source = "1234567890.dkr.ecr.us-west-2.amazonaws.com/image-name:image-tag"
essential = true

where image-name is the ECR repository name and image-tag is the particular tag you want. If that doesn't work for you, I'd recommend cutting an issue separately for this here and provide more data about what you are trying and what version you are using because there might be a bug if the above doesn't work.

[vchepkov]

Thank you, @yeazelm, I figured out my issue. ECR doesn't handle latest like artifactory does, I would need to find a workaround. Sorry for the noise.