How do I re-tag an image in ECR?

Question

I'm trying to follow along with Retagging an Image with the AWS CLI and am beginning to suspect this guide is out-of-date. I have a number of Docker images pushed into an ECR repository - let's call it "myappserver." And so I can run commands like this one to see a list of all the images in the ECR repository:

aws ecr describe-images --repository-name myappserver

The output I get from that command looks something like this:

{
    "imageDetails": [
        {
            "registryId": "123456789012",
            "repositoryName": "myappserver",
            "imageDigest": "sha256:1234...",
            "imageSizeInBytes": 33805114,
            "imagePushedAt": 1525881170.0
        },
        {
            "registryId": "123456789012",
            "repositoryName": "myappserver",
            "imageDigest": "sha256:1234...",
            "imageTags": [
                "latest"
            ],
            "imageSizeInBytes": 333805137,
            "imagePushedAt": 1525892193.0
        },
        ...
    ]
}

Because not all of my images have tags any more, I want to identify them by imageDigest (instead of imageTag like the guide does), which should be fine. However, the command that the guide offers doesn't seem to work any more. It says:

Use the batch-get-image command to get the image manifest for the image to retag and write it to an environment variable. In this example, the manifest for an image with the tag, latest, in the repository, amazonlinux, is written to the environment variable, MANIFEST.

MANIFEST=$(aws ecr batch-get-image --repository-name amazonlinux --image-ids imageTag=latest --query images[].imageManifest --output text)

So, naturally, I try to run this command:

aws ecr batch-get-image --repository-name myappserver --image-ids imageDigest=sha256:1234... --query images[].imageManifest --output text

But the response I get in the terminal is:

zsh: no matches found: images[].imageManifest

Interestingly enough, if I omit the last two parameters (--query images[].imageManifest and --output text) then that command does succeed and returns a bit of JSON. So I tried to copy/paste that JSON by hand into an environment variable - specifically copying the section labeled "imageManifest." Then, using that environment variable (which I've named MANIFEST to stay consistent with the nomenclature that the guide uses), I tried to run this command:

aws ecr put-image --repository-name myappserver --image-tag new-tag --image-manifest "$MANIFEST"

However, that results in the following error message:

An error occurred (InvalidParameterException) when calling the PutImage operation: Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Invalid JSON syntax'

As far as I can tell, the JSON output that I copied into the put-image command is valid, despite that error. And I'm also confused why I'm unable to run the batch-get-image command with the provided arguments. What can I do to get these commands working, and to add tags to my image?

score 13 · Accepted Answer · edited Jul 01 '19 at 22:16

13

You're getting a shell error (zsh) that says the wildcard expression images[].imageManifest didn't match any files on your local disk.

Try using quotes:

--query 'images[].imageManifest'

instead of this:

--query images[].imageManifest

edited Jul 01 '19 at 22:16

Ken Williams

22,756
10
85
147

answered May 24 '18 at 06:28

Ido Levy

146
1
3

Ack. Either one works as long as I add the quotes. Thanks! – soapergem May 24 '18 at 16:14
See also: https://stackoverflow.com/questions/64686471/retagging-image-on-aws-ecr-creates-new-image/70581114#70581114 – user3528000 Jan 04 '22 at 15:25

score 3 · Answer 2 · answered Feb 22 '21 at 17:08

3

I Just passed by the same problem.

# This script tags a untagged ECR Images using its diggest
ECR_REPO=my-ecr-repo-name
IMAGE_DIGEST="sha256:ab6DSA4f1f940df430062009fdfb02d3ede74b48e39ada939047c2e7d0ee3ac50d8"
TAG=my-tag
# ---
MANIFEST=$(aws ecr batch-get-image --repository-name $ECR_REPO --image-ids imageDigest=$IMAGE_DIGEST --query 'images[].imageManifest' --output text)
aws ecr put-image --repository-name $ECR_REPO --image-tag $TAG --image-manifest "$MANIFEST"

You can see the gist:

https://gist.github.com/anderson-marques/38b802189bb8bc1cf37299cc60d653d4

answered Feb 22 '21 at 17:08

Anderson Marques

808
8
13

It seems to create a new tag not tag an untagged image. The manifest however looks weird with a lot of \r\n's – Teebu Aug 11 '21 at 04:03
@Teebu it worked perfectly fine for me. It did exactly what it was expected to do (tag untagged image) by providing the untagged image Digest – Ili Apr 13 '23 at 10:59

slow · Answer 3 · 2022-06-13T16:56:40.043

Somewhat related:

The aws ecr ... --output text command does not preserve whitespace. When I tried to re-tag an image, it showed up with a different digest value.

Bad way

The following introduced carriage returns (\r\n) on macosx:

MANIFEST=$(aws ecr batch-get-image --repository-name amazonlinux --image-ids imageTag=latest --output text --query 'images[].imageManifest')

Good way

This extracted the proper value, but required jq:

MANIFEST=$(aws ecr batch-get-image --repository-name amazonlinux --image-ids imageTag=latest --output json | jq --raw-output '.images[].imageManifest')

Difference

... --output text --query 'images[].imageManifest'

vs

... --output json | jq --raw-output '.images[].imageManifest'

JQ seems to be the cleaner way. – Teebu Aug 12 '21 at 03:32 — Teebu, Aug 12 '21 at 03:32

Roelant · Answer 4 · 2022-05-29T08:24:56.470

1

For those in windows, I needed to juggle a bit with the JSON

$MANIFEST = aws ecr batch-get-image --repository-name REPO --image-ids "imageDigest=sha256:DIGEST" --query 'images[].imageManifest' --output json 
$x = $MANIFEST | ConvertFrom-Json
$y = $x.replace('\n', ' ').replace("`n", " ")
aws ecr put-image --repository-name REPO --image-tag 2018.12 --image-manifest "$y"

edited May 29 '22 at 08:24

answered May 26 '20 at 09:01

Roelant

4,508
1
32
62

This didn't change anything for me $y = $x.replace('\n', ' ') This worked: $y = $x.replace("`n", " ") – acivic2nv May 26 '22 at 12:24
backtick n? Surprising, but i'll add it :) – Roelant May 29 '22 at 08:25
Error when running your code. An error occurred (InvalidParameterException) when calling the PutImage operation: Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Invalid JSON syntax' Any suggestions? – GGG Jul 15 '22 at 19:57
When I run $MANIFEST the terminal shows ["{\n \"schemaVersion\": 2... and when $y, it displays {"schemaVersion": 2... Looks like API expects the JSON being put into an array brackets [] Well, adding [] didn't help either. Any help is appreciated. – GGG Jul 15 '22 at 20:21
Hmm seems this is broken indeed. Would have to dive in. You could try to use the file:// syntax provided in the docs. Let me know if it works! https://docs.aws.amazon.com/cli/latest/reference/ecr/put-image.html – Roelant Jul 19 '22 at 13:37
$z = $y | ConvertTo-Json, in case of a json error – Ben Rhouma Zied Oct 03 '22 at 16:03

score 0 · Answer 5 · answered Jul 06 '23 at 09:25

I encountered a similar error while attempting to retag an image that already had one tag.

MANIFEST=$(aws ecr batch-get-image --repository-name amazonlinux --image-ids imageTag=latest --output text --query images[].imageManifest)
(source)

Then use,

aws ecr put-image --repository-name amazonlinux --image-tag $IMAGE_TAG --image-manifest "$MANIFEST" --image-manifest-media-type application/vnd.docker.distribution.manifest.v2+json
(source)

How do I re-tag an image in ECR?

5 Answers5

Bad way

Good way

Difference

Linked