Go to Qiita Advent Calendar 2024 Top
LoginSignup
1
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 1 year has passed since last update.

@afukuma

ECRにDocker HUBのイメージをおく

Last updated at Posted at 2022-08-07

まえがき

プライベートなVPCでdocker pullしたい👉ECRからイメージを持ってくる

概要

CloudFormationテンプレートでCodeBuildプロジェクト作っておき
AWS　CLIでイメージ名・タグを指定してCodeBuildを実行する

CloudFormation

  • CodeBuild用のロールを作る
  • CodeBuildのプロジェクトを作る

CloudFormationテンプレートはこちら👇

----------------------------------------
   全体を表示（折りたたみ）
 ------------------------------------------
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  ImageName:
    Type: "String"
    Default: "hello-world"
  ImageTag:
    Type: "String"
    Default: "latest"
Resources:
  RoleforCodeBuild:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: '/service-role/'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Policies:
        - PolicyName: codebuildpolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:CompleteLayerUpload
                  - ecr:InitiateLayerUpload
                  - ecr:PutImage
                  - ecr:UploadLayerPart
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:CreateReportGroup
                  - codebuild:CreateReport
                  - codebuild:UpdateReport
                  - codebuild:BatchPutTestCases
                  - codebuild:BatchPutCodeCoverages
                Resource: !Sub arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                Resource: !Sub arn:${AWS::Partition}:s3:::codepipeline-ap-northeast-1-*
  CodeBuildImageCopy:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: ECRImport-Common
      Description: Create ECR Repository(Name.. ImageTag) Before Exec.
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: "NO_SOURCE"
        BuildSpec: |
            version: 0.2
            env:
              shell: bash
            phases:
              pre_build:
                commands:
                  - aws --version
                  - docker --version
                  - ACCID=$(aws sts get-caller-identity --query Account --output text)
              build:
                commands:
                  - docker pull $IMAGENAME:$IMAGETAG
                  - docker tag $IMAGENAME:$IMAGETAG $ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGENAME:$IMAGETAG
                  - docker images
                  - aws ecr get-login-password | docker login --username AWS --password-stdin https://$ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
                  - docker push $ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGENAME:$IMAGETAG
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        ComputeType: BUILD_GENERAL1_SMALL
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: IMAGENAME
            Type: PLAINTEXT
            Value: hello-world
          - Name: IMAGETAG
            Type: PLAINTEXT
            Value: latest
      TimeoutInMinutes: 5
      QueuedTimeoutInMinutes: 5
      Artifacts:
        Type: NO_ARTIFACTS

実行方法

例えば、docker pull nginx:1.9で取得できるイメージが欲しい場合

CLI

まず、ECRレポジトリを作る

$IMAGENAME="nginx"
aws ecr create-repository --repository-name $IMAGENAME --image-scanning-configuration scanOnPush=true

CodeBuildにパラメータを渡して実行

$IMAGENAME="nginx"
$IMAGETAG="1.９"
aws codebuild start-build --project-name ECRImport-Common `
--environment-variables-override `
name=IMAGENAME,value=$IMAGENAME,type=PLAINTEXT name=IMAGETAG,value=$IMAGETAG,type=PLAINTEXT

起動パラメータ
ImageName docker pull で指定するイメージ名
ImageTag イメージタグ(デフォルト：latest) 
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  ImageName:
    Type: "String"
    Default: "hello-world"
  ImageTag:
    Type: "String"
    Default: "latest"

１、CodeBuild用のロールを作る

長ったらしい理由…
CloudWatchLogsとECRアップロード関係のみで動作はするが、CodeBuildの親切（）機能により、不足しているポリシーを追加してくれる様子？
これをやられると、CloudFormation Stackが削除できなくなる（ロールのみ消えない）
なので、補完してくれるポリシーを先に追加しておく

Resources:
  RoleforCodeBuild:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: '/service-role/'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Policies:
        - PolicyName: codebuildpolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:CompleteLayerUpload
                  - ecr:InitiateLayerUpload
                  - ecr:PutImage
                  - ecr:UploadLayerPart
                Resource: "*"
              - Effect: Allow
                Action:
                  - codebuild:CreateReportGroup
                  - codebuild:CreateReport
                  - codebuild:UpdateReport
                  - codebuild:BatchPutTestCases
                  - codebuild:BatchPutCodeCoverages
                Resource: !Sub arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/*
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                Resource: !Sub arn:${AWS::Partition}:s3:::codepipeline-ap-northeast-1-*

２、CodeBuildのプロジェクトを作る

BuildSpecで

  • 欲しいイメージをdocker pullで取得する
  • タグをつける
  • ECRにログインする
  • ECRにpushする

  CodeBuildImageCopy:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: ECRImport-Common
      Description: Create ECR Repository(Name.. ImageTag) Before Exec.
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: "NO_SOURCE"
        BuildSpec: |
            version: 0.2
            env:
              shell: bash
            phases:
              pre_build:
                commands:
                  - aws --version
                  - docker --version
                  - ACCID=$(aws sts get-caller-identity --query Account --output text)
              build:
                commands:
                  - docker pull $IMAGENAME:$IMAGETAG
                  - docker tag $IMAGENAME:$IMAGETAG $ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGENAME:$IMAGETAG
                  - docker images
                  - aws ecr get-login-password | docker login --username AWS --password-stdin https://$ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
                  - docker push $ACCID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGENAME:$IMAGETAG
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        ComputeType: BUILD_GENERAL1_SMALL
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: IMAGENAME
            Type: PLAINTEXT
            Value: hello-world
          - Name: IMAGETAG
            Type: PLAINTEXT
            Value: latest
      TimeoutInMinutes: 5
      QueuedTimeoutInMinutes: 5
      Artifacts:
        Type: NO_ARTIFACTS

あとがき

Docker Hubの制限により、たまにダウンロードできないことがあります。
ガチャです

回避方法は「Codebuild Dockerhub limit」などでググれば出てきますが

  • dockerhubの認証を追加する
  • CodeBuildをVPCに接続して通信経路をNATGW経由にする
    など。。
1
2
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?