Containers-roadmap: [ECR] [Tags]: immutable image tags

[jtoberon]

After an image tag is pushed to a repository, prevent a user from pushing an update that points the tag to a different image. This feature can be used to ensure that an image tag such as "2.1.1" refers to the same content over time. Such tags can be easier to use than the longer image digest.

An example of the pros and cons of using mutable image tags can be found here.

[rpnguyen]

🎉 https://aws.amazon.com/about-aws/whats-new/2019/07/amazon-ecr-now-supports-immutable-image-tags/

[yrsurya]

Hello all , we create two tags for the image where one is latest and another is Jenkins build number but with recently released tag immutability where we enabled for repo seems to be latest tag is not being tagged to the recent image as it not able to overwrite . Any one faced similar situation

[FernandoMiguel]

@yrsurya that's the all point if immutable tags.
Your latest tag is just like any other tag (it has no special meaning) and now refers to the 1st image it tagged

[yrsurya]

I was in a impression that image which pushed recently will be getting latest tag by default. Is there any way we can get that(latest) by default after enabling immutable option on ECR as we use latest tagged base images for the application to built on top of

FROM xxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/corretto11:latest
VOLUME ["/tmp"]
ADD ${project.name}-${version}.jar /
EXPOSE 8080
ENTRYPOINT [xxx]

[therealppa]

@yrsurya You could use the cli to untag _latest_ before tagging your new image.

https://docs.aws.amazon.com/cli/latest/reference/ecr/untag-resource.html

[Roberdvs]

Nexus now allows redeploying the 'latest' tag even if tag immutability is enabled, which is very convenient.

Having the same on ECR would be nice.

[mike-stewart]

We have the same issue with the latest tag. I've opened a new issue in https://github.com/aws/containers-roadmap/issues/878.

[pablote]

The link @therealppa suggests is not working for me. Is it possible that it refers to some other type of tags, like aws resource tags, but not really docker container image tags?

[therealppa]

@pablote Looking at the description, you're probably right. According to https://stackoverflow.com/questions/56299191/remove-tag-from-image the correct command should be aws ecr batch-delete-image --repository-name <REPO NAME> --image-ids imageTag=<TAG NAME>