Containers-roadmap: ECR [request]: expose image labels in DescribeImages response

[alexrudd]

Hi!

Tell us about your request
I would like image labels to be exposed over the DescribeImages API. Docker labels are the only way to add immutable metadata to an image, having a way to view that data without pulling the image down would be really useful!

Which service(s) is this request for?
ECR

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We'd like to add metadata about a particular docker image to the image itself. Info such as: git hash, date built, repository, branch, etc; and then be able to lookup that data remotely using the ECR API.

This data is useful for working backwards from a container running in ECS, to the exact source that it was built from. Tags can serve a similar purpose but they're mutable and not connected directly to the image itself.

Thank you!

[lloydpick]

We are also starting to go down this path, and need access to the docker labels without having to pull the image from ECR. OCI is also now publishing a standard for the labels here - https://github.com/opencontainers/image-spec/blob/master/annotations.md Obviously there can be more than their own, it just would be nice to see these in the interface and the API.

[tomwillfixit]

We are using OCI labelling throughout the CI/CD pipeline and being able to query these labels using awscli or through the ECR API would be incredibly useful. Is there any type of workaround to access the labels without pulling the entire image? Thanks :)

[samuelkarp]

You can access the manifest of an image stored in ECR without pulling the entire image today. The manifest can be retrieved through the BatchGetImage API, and you can then parse the manifest to find annotations that are stored there. While this isn't the friendliest way to get at the annotations, it might be a reasonable work-around for you if you already know which image(s) you want to examine.

[tomwillfixit]

Thanks Samuel. That is useful to know. I was able to get the manifest but the labels which I see when running docker inspect against an image are not in the manifest. For example I'm looking to get at these labels :

"Labels": {
"com..image.created": "Wed 30 Oct 2019 17:11:16 GMT",
"com.image.maintainer": "tom",
"com.image.revision": "123456",
"com.image.source": "blah",
"com.image.title": "blah v2.0.1"
}

[TheTweak]

@tomwillfixit try to pass "application/vnd.docker.distribution.manifest.v1+json" in acceptedMediaTypes parameter in BatchGetImage. Labels should be in "history" array in the response.

[tomwillfixit]

Thank you. This works.

aws ecr batch-get-image --repository-name --image-id imageTag= --accepted-media-types "application/vnd.docker.distribution.manifest.v1+json" --output text

[tomwillfixit]

One liner to return labels :

aws ecr batch-get-image --repository-name --image-id imageTag= --accepted-media-types "application/vnd.docker.distribution.manifest.v1+json" --output json |jq -r '.images[].imageManifest' |jq -r '.history[0].v1Compatibility' |jq -r '.config.Labels'

[Dejulia489]

Thanks this works great! Added the to the command and the PowerShell version

aws ecr batch-get-image --repository-name <repo_name> --image-id imageTag=<tag_name> --accepted-media-types "application/vnd.docker.distribution.manifest.v1+json" --output json |jq -r '.images[].imageManifest' |jq -r '.history[0].v1Compatibility' |jq -r '.config.Labels'

(((aws ecr batch-get-image --repository-name <repo_name> --image-id imageTag=<tag_name> --accepted-media-types "application/vnd.docker.distribution.manifest.v1+json" --output json | convertFrom-Json -ov a).images.imageManifest | ConvertFrom-Json).history.v1Compatibility | convertFrom-Json).Config.Labels

[CONJAUMCGCG]

It does work with --image-id imageTag=.
But does not work if I pass --image-id imageDigest= instead of the imageTag.
aws ecr batch-get-image --repository-name --image-id imageDigest= --accepted-media-types "application/vnd.docker.distribution.manifest.v1+json" --output json |jq -r '.images[].imageManifest' |jq -r '.history[0].v1Compatibility' |jq -r '.config.Labels'

[priyendra]

Any idea why this command works with tags but does not return the same information when we pass in the image digest? Is there an active open issue where this is being tracked?