如何将已创建的Docker镜像及外部Docker镜像一次性推送至AWS ECR？除AWS CodeBuild外还有哪些实现方式？

AI 小北

2026-4-30

Great question! Beyond AWS CodeBuild, there are several solid alternatives to push both your local/existing Docker images and external images to AWS ECR—whether you want to roll your own scripts or use other popular CI/CD tools. Let’s dive into each option:

Custom Shell Scripts (Manual or Scheduled)

If you prefer full control over the process or need a lightweight solution, a custom shell script works perfectly. You can run it manually, schedule it via cron, or trigger it with AWS EventBridge for automation.

Here’s a sample script that handles both local and external images:

#!/bin/bash
# Configure your AWS details
REGION="us-east-1"
ACCOUNT_ID="123456789012"

# Step 1: Authenticate to AWS ECR
aws ecr get-login-password --region $REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com

# Step 2: Push local Docker images
LOCAL_IMAGES=("my-app:v1" "my-service:latest")
for IMAGE in "${LOCAL_IMAGES[@]}"; do
  # Split image name and tag
  IMAGE_NAME="${IMAGE%:*}"
  IMAGE_TAG="${IMAGE##*:}"
  # Create ECR-compatible tag
  ECR_URI="$ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$IMAGE_NAME:$IMAGE_TAG"
  # Tag and push
  docker tag $IMAGE $ECR_URI
  docker push $ECR_URI
done

# Step 3: Pull and push external images
EXTERNAL_IMAGES=("nginx:1.25-alpine" "postgres:15")
for IMAGE in "${EXTERNAL_IMAGES[@]}"; do
  docker pull $IMAGE
  IMAGE_NAME="${IMAGE%:*}"
  IMAGE_TAG="${IMAGE##*:}"
  ECR_URI="$ACCOUNT_ID.dkr.ecr.$REGION.amazonaws.com/$IMAGE_NAME:$IMAGE_TAG"
  docker tag $IMAGE $ECR_URI
  docker push $ECR_URI
done

Pro tip: Store your AWS credentials securely using environment variables or AWS IAM roles (if running on EC2/EKS) instead of hardcoding them.

GitHub Actions

If your code lives on GitHub, GitHub Actions is a seamless choice for integrating image pushes directly into your workflow. It’s cloud-native, easy to configure, and integrates with GitHub Secrets for secure credential management.

Create a .github/workflows/push-to-ecr.yml file with this configuration:

name: Push Docker Images to ECR
# Trigger on pushes to main or manual runs
on:
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  push-images:
    runs-on: ubuntu-latest
    steps:
      # Configure AWS credentials using GitHub Secrets
      - name: Set up AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      # Log in to ECR
      - name: Authenticate to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      # Push local images
      - name: Push local Docker images
        run: |
          LOCAL_IMAGES=("my-app:v1" "my-service:latest")
          for IMAGE in "${LOCAL_IMAGES[@]}"; do
            IMAGE_NAME="${IMAGE%:*}"
            IMAGE_TAG="${IMAGE##*:}"
            ECR_URI="${{ steps.login-ecr.outputs.registry }}/$IMAGE_NAME:$IMAGE_TAG"
            docker tag $IMAGE $ECR_URI
            docker push $ECR_URI
          done

      # Pull and push external images
      - name: Push external Docker images
        run: |
          EXTERNAL_IMAGES=("nginx:1.25-alpine" "postgres:15")
          for IMAGE in "${EXTERNAL_IMAGES[@]}"; do
            docker pull $IMAGE
            IMAGE_NAME="${IMAGE%:*}"
            IMAGE_TAG="${IMAGE##*:}"
            ECR_URI="${{ steps.login-ecr.outputs.registry }}/$IMAGE_NAME:$IMAGE_TAG"
            docker tag $IMAGE $ECR_URI
            docker push $ECR_URI
          done

GitLab CI/CD

For GitLab users, GitLab CI/CD offers similar functionality with a .gitlab-ci.yml file. It uses Docker-in-Docker (DinD) to run Docker commands in the pipeline.

Here’s a sample configuration:

stages:
  - push-to-ecr

push-images:
  stage: push-to-ecr
  image: docker:latest
  services:
    - docker:dind  # Enable Docker-in-Docker
  variables:
    AWS_REGION: us-east-1
    AWS_ACCOUNT_ID: 123456789012
  before_script:
    # Install AWS CLI in the Docker image
    - apk add --no-cache aws-cli
    # Authenticate to ECR
    - aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com
  script:
    # Push local images
    - |
      LOCAL_IMAGES=("my-app:v1" "my-service:latest")
      for IMAGE in "${LOCAL_IMAGES[@]}"; do
        IMAGE_NAME="${IMAGE%:*}"
        IMAGE_TAG="${IMAGE##*:}"
        ECR_URI="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_NAME:$IMAGE_TAG"
        docker tag $IMAGE $ECR_URI
        docker push $ECR_URI
      done
    # Push external images
    - |
      EXTERNAL_IMAGES=("nginx:1.25-alpine" "postgres:15")
      for IMAGE in "${EXTERNAL_IMAGES[@]}"; do
        docker pull $IMAGE
        IMAGE_NAME="${IMAGE%:*}"
        IMAGE_TAG="${IMAGE##*:}"
        ECR_URI="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_NAME:$IMAGE_TAG"
        docker tag $IMAGE $ECR_URI
        docker push $ECR_URI
      done
  only:
    - main  # Trigger only on pushes to main branch

Don’t forget to add your AWS credentials as CI/CD variables in your GitLab project settings (under Settings > CI/CD > Variables).

Jenkins Pipeline

If you’re using an on-prem or self-hosted Jenkins instance, you can create a pipeline to handle image pushes. You’ll need the AWS Credentials and Docker plugins installed first.

Here’s a sample Jenkinsfile:

pipeline {
  agent any
  environment {
    AWS_REGION = 'us-east-1'
    AWS_ACCOUNT_ID = '123456789012'
    # Reference AWS credentials stored in Jenkins
    AWS_CREDENTIALS = credentials('aws-ecr-service-account')
  }
  stages {
    stage('Authenticate to ECR') {
      steps {
        script {
          sh "aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com"
        }
      }
    }
    stage('Push Local Images') {
      steps {
        script {
          def localImages = ['my-app:v1', 'my-service:latest']
          localImages.each { image ->
            def imageParts = image.split(':')
            def ecrUri = "${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${imageParts[0]}:${imageParts[1]}"
            sh "docker tag ${image} ${ecrUri}"
            sh "docker push ${ecrUri}"
          }
        }
      }
    }
    stage('Push External Images') {
      steps {
        script {
          def externalImages = ['nginx:1.25-alpine', 'postgres:15']
          externalImages.each { image ->
            sh "docker pull ${image}"
            def imageParts = image.split(':')
            def ecrUri = "${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${imageParts[0]}:${imageParts[1]}"
            sh "docker tag ${image} ${ecrUri}"
            sh "docker push ${ecrUri}"
          }
        }
      }
    }
  }
}

Each option has its own strengths: scripts are great for ad-hoc or custom workflows, GitHub/GitLab CI integrate tightly with your code repo, and Jenkins is ideal for enterprise environments with existing tooling.

内容的提问来源于stack exchange，提问作者shreya chouhan