ecr

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 34 Imported by: 0

README

ECR

Parity grade: A · SDK aws-sdk-go-v2/service/ecr@v1.59.0 · last audited 2026-07-24 (fba3c784+uncommitted)

Coverage

Metric Value
Operations audited 58 (58 ok)
Known gaps none
Deferred items 2
Resource leaks clean
Deferred
  • docker registry v2 proxy internals (pkgs distribution/v3 wiring) — treated as a vendored subsystem, not re-audited this pass
  • chaos/fault-injection interaction with ECR ops — not exercised this pass

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrRepositoryNotFound is returned when a repository does not exist.
	ErrRepositoryNotFound = awserr.New("RepositoryNotFoundException", awserr.ErrNotFound)
	// ErrRepositoryAlreadyExists is returned when a repository already exists.
	ErrRepositoryAlreadyExists = awserr.New(
		"RepositoryAlreadyExistsException",
		awserr.ErrAlreadyExists,
	)
	// ErrRepositoryNotEmpty is returned when deleting a non-empty repository without the force flag.
	ErrRepositoryNotEmpty = awserr.New("RepositoryNotEmptyException", awserr.ErrConflict)
	// ErrImageTagAlreadyExists is returned when re-tagging an image in an IMMUTABLE repository.
	ErrImageTagAlreadyExists = awserr.New("ImageTagAlreadyExistsException", awserr.ErrConflict)
	// ErrInvalidRepositoryName is returned when the repository name is invalid.
	ErrInvalidRepositoryName = errors.New("InvalidParameterException")
	// ErrPullThroughCacheRuleNotFound is returned when a pull-through cache rule does not exist.
	ErrPullThroughCacheRuleNotFound = awserr.New(
		"PullThroughCacheRuleNotFoundException",
		awserr.ErrNotFound,
	)
	// ErrPullThroughCacheRuleAlreadyExists is returned when a pull-through cache rule already exists.
	ErrPullThroughCacheRuleAlreadyExists = awserr.New(
		"PullThroughCacheRuleAlreadyExistsException",
		awserr.ErrAlreadyExists,
	)
	// ErrLifecyclePolicyNotFound is returned when a lifecycle policy does not exist.
	ErrLifecyclePolicyNotFound = awserr.New("LifecyclePolicyNotFoundException", awserr.ErrNotFound)
	// ErrRepositoryCreationTemplateNotFound is returned when a creation template does not exist.
	ErrRepositoryCreationTemplateNotFound = awserr.New(
		"TemplateNotFoundException",
		awserr.ErrNotFound,
	)
	// ErrRepositoryCreationTemplateAlreadyExists is returned when a creation template prefix already exists.
	ErrRepositoryCreationTemplateAlreadyExists = awserr.New(
		"TemplateAlreadyExistsException",
		awserr.ErrAlreadyExists,
	)
	// ErrRegistryPolicyNotFound is returned when the registry policy does not exist.
	ErrRegistryPolicyNotFound = awserr.New("RegistryPolicyNotFoundException", awserr.ErrNotFound)
	// ErrRepositoryPolicyNotFound is returned when a repository-level IAM policy does not exist.
	ErrRepositoryPolicyNotFound = awserr.New(
		"RepositoryPolicyNotFoundException",
		awserr.ErrNotFound,
	)
	// ErrImageNotFound is returned when a requested image does not exist in a repository.
	ErrImageNotFound = awserr.New("ImageNotFoundException", awserr.ErrNotFound)
	// ErrScanNotFoundException is returned when DescribeImageScanFindings is called
	// on an image that has never had a scan started.
	ErrScanNotFoundException = awserr.New("ScanNotFoundException", awserr.ErrNotFound)
)
View Source 
var (
	// ErrLayerInaccessible is returned when a layer exists but is not accessible.
	ErrLayerInaccessible = awserr.New("LayerInaccessibleException", awserr.ErrNotFound)
	// ErrLayersNotFound is returned when requested layers do not exist in the repository.
	ErrLayersNotFound = awserr.New("LayersNotFoundException", awserr.ErrNotFound)
	// ErrLayerAlreadyExists is returned when CompleteLayerUpload is called with a
	// digest that has already been registered as an available layer in the
	// repository (matches AWS: "The image layer already exists in the associated
	// repository.").
	ErrLayerAlreadyExists = awserr.New("LayerAlreadyExistsException", awserr.ErrAlreadyExists)
	// ErrInvalidLayerPart is returned when an UploadLayerPart's first byte is not
	// consecutive to the last byte received by a previous part in the same
	// upload session (matches AWS InvalidLayerPartException).
	ErrInvalidLayerPart = awserr.New("InvalidLayerPartException", awserr.ErrInvalidParameter)
	// ErrImageDigestDoesNotMatch is returned when a caller-supplied imageDigest on
	// PutImage does not match the digest ECR computes from the image manifest.
	ErrImageDigestDoesNotMatch = awserr.New(
		"ImageDigestDoesNotMatchException",
		awserr.ErrInvalidParameter,
	)
	// ErrUploadNotFound is returned when CompleteLayerUpload or UploadLayerPart is
	// called with an uploadId that matches no live InitiateLayerUpload session for
	// the given repository (matches AWS UploadNotFoundException: "The upload could
	// not be found, or the specified upload ID is not valid for this repository.").
	ErrUploadNotFound = awserr.New("UploadNotFoundException", awserr.ErrNotFound)
	// ErrEmptyUpload is returned when CompleteLayerUpload is called on a live
	// upload session that never received any UploadLayerPart data (matches AWS
	// EmptyUploadException: "The specified layer upload does not contain any
	// layer parts.").
	ErrEmptyUpload = awserr.New("EmptyUploadException", awserr.ErrInvalidParameter)
	// ErrLayerPartTooSmall is returned when CompleteLayerUpload finds a non-final
	// uploaded part smaller than the 5MiB minimum (matches AWS
	// LayerPartTooSmallException: "Layer parts must be at least 5 MiB in size.").
	ErrLayerPartTooSmall = awserr.New("LayerPartTooSmallException", awserr.ErrInvalidParameter)
	// ErrImageAlreadyExists is returned when PutImage re-pushes a manifest that is
	// already registered under the exact same tag -- a complete no-op push (matches
	// AWS ImageAlreadyExistsException: "The specified image has already been
	// pushed, and there were no changes to the manifest or image tag after the
	// last push."). Independent of repository tag mutability, which instead
	// governs the distinct ImageTagAlreadyExistsException case (retagging to a
	// different digest).
	ErrImageAlreadyExists = awserr.New("ImageAlreadyExistsException", awserr.ErrConflict)
)
View Source 
var ErrLayerDigestMismatch = awserr.New("InvalidLayerException", awserr.ErrInvalidParameter)

ErrLayerDigestMismatch is returned when the provided digest does not match the uploaded bytes.

View Source 
var ErrNilAppContext = errors.New("AppContext is required")

ErrNilAppContext is returned by Init when appCtx is nil.

Functions

This section is empty.

Types

type AwsEcrContainerImageDetails 

type AwsEcrContainerImageDetails struct {
	Architecture   string   `json:"architecture,omitempty"`
	ImageHash      string   `json:"imageHash,omitempty"`
	Platform       string   `json:"platform,omitempty"`
	RegistryID     string   `json:"registryId,omitempty"`
	RepositoryName string   `json:"repositoryName,omitempty"`
	ImageTags      []string `json:"imageTags,omitempty"`
	PushedAt       float64  `json:"pushedAt"`
}

AwsEcrContainerImageDetails describes the ECR image an enhanced finding covers.

type Backend 

type Backend interface {
	// CreateRepository creates a new ECR repository and returns its metadata.
	// Returns ErrRepositoryAlreadyExists if a repository with that name already
	// exists, or ErrInvalidRepositoryName when name is empty.
	// imageTagMutability defaults to "MUTABLE" when empty.
	// encryptionType defaults to "AES256" when empty; kmsKey is only used with "KMS".
	CreateRepository(
		ctx context.Context,
		name, imageTagMutability string,
		scanOnPush bool,
		encryptionType, kmsKey string,
	) (*Repository, error)

	// DescribeRepositories returns repository metadata, optionally filtered by
	// the provided names. Passing an empty slice returns all repositories.
	// Returns ErrRepositoryNotFound if any requested name does not exist.
	DescribeRepositories(ctx context.Context, names []string) ([]Repository, error)

	// DeleteRepository removes the named repository and returns its metadata.
	// Returns ErrRepositoryNotFound if the repository does not exist.
	DeleteRepository(ctx context.Context, name string) (*Repository, error)

	// ProxyEndpoint returns the registry endpoint embedded in repository URIs
	// and returned by GetAuthorizationToken.
	ProxyEndpoint() string

	// SetEndpoint updates the registry endpoint used in new repository URIs.
	// It should be called once the server's listening address is known.
	SetEndpoint(endpoint string)

	// BatchCheckLayerAvailability checks the availability of image layers.
	BatchCheckLayerAvailability(
		ctx context.Context,
		repositoryName string,
		layerDigests []string,
	) ([]LayerAvailability, []LayerFailure, error)

	// BatchDeleteImage deletes specified images from a repository.
	BatchDeleteImage(
		ctx context.Context,
		repositoryName string,
		imageIDs []ImageIdentifier,
	) ([]ImageIdentifier, []ImageFailure, error)

	// BatchGetImage gets details for specified images.
	BatchGetImage(
		ctx context.Context,
		repositoryName string,
		imageIDs []ImageIdentifier,
	) ([]Image, []ImageFailure, error)

	// DescribeImages returns image details for a repository.
	DescribeImages(ctx context.Context, repositoryName string, imageIDs []ImageIdentifier) ([]Image, error)

	// BatchGetRepositoryScanningConfiguration gets scanning config for repositories.
	BatchGetRepositoryScanningConfiguration(
		ctx context.Context,
		repositoryNames []string,
	) ([]RepositoryScanningConfiguration, []RepositoryScanningConfigurationFailure, error)

	// CompleteLayerUpload completes the upload of an image layer.
	CompleteLayerUpload(
		ctx context.Context,
		repositoryName, uploadID string,
		layerDigests []string,
	) (*CompleteLayerUploadResult, error)

	// GetDownloadURLForLayer resolves a download URL for a repository layer.
	GetDownloadURLForLayer(ctx context.Context, repositoryName, layerDigest string) (string, error)

	// InitiateLayerUpload starts a layer upload session.
	InitiateLayerUpload(ctx context.Context, repositoryName string) (*LayerUploadInitiation, error)

	// UploadLayerPart records uploaded bytes for an existing session.
	UploadLayerPart(
		ctx context.Context,
		repositoryName, uploadID string,
		firstByte, lastByte int64,
		blob []byte,
	) (*LayerUploadPartResult, error)

	// CreatePullThroughCacheRule creates a pull-through cache rule.
	CreatePullThroughCacheRule(
		ctx context.Context,
		prefix, upstreamURL, credentialArn, upstreamRegistry, customRoleArn, upstreamRepositoryPrefix string,
	) (*PullThroughCacheRule, error)

	// DescribePullThroughCacheRules lists pull-through cache rules.
	DescribePullThroughCacheRules(ctx context.Context, prefixes []string) ([]PullThroughCacheRule, error)

	// CreateRepositoryCreationTemplate creates a repository creation template.
	CreateRepositoryCreationTemplate(
		ctx context.Context,
		req *RepositoryCreationTemplate,
	) (*RepositoryCreationTemplate, error)

	// DeleteRepositoryCreationTemplate deletes a repository creation template.
	DeleteRepositoryCreationTemplate(ctx context.Context, prefix string) (*RepositoryCreationTemplate, error)

	// DescribeRepositoryCreationTemplates lists repository creation templates.
	DescribeRepositoryCreationTemplates(ctx context.Context, prefixes []string) ([]RepositoryCreationTemplate, error)

	// DeleteLifecyclePolicy deletes the lifecycle policy for a repository.
	DeleteLifecyclePolicy(ctx context.Context, repositoryName string) (*LifecyclePolicyResult, error)

	// GetLifecyclePolicy returns the lifecycle policy for a repository.
	GetLifecyclePolicy(ctx context.Context, repositoryName string) (*LifecyclePolicyResult, error)

	// GetLifecyclePolicyPreview returns the current lifecycle policy preview.
	GetLifecyclePolicyPreview(ctx context.Context, repositoryName string) (*LifecyclePolicyPreviewResult, error)

	// PutLifecyclePolicy creates or replaces the lifecycle policy for a repository.
	PutLifecyclePolicy(ctx context.Context, repositoryName, policyText string) (*LifecyclePolicyResult, error)

	// StartLifecyclePolicyPreview starts or refreshes a lifecycle policy preview.
	StartLifecyclePolicyPreview(
		ctx context.Context,
		repositoryName, policyText string,
	) (*LifecyclePolicyPreviewResult, error)

	// DeletePullThroughCacheRule deletes a pull-through cache rule by prefix.
	DeletePullThroughCacheRule(ctx context.Context, prefix string) (*PullThroughCacheRule, error)

	// UpdatePullThroughCacheRule updates a pull-through cache rule by prefix.
	UpdatePullThroughCacheRule(
		ctx context.Context,
		prefix, credentialArn, customRoleArn string,
	) (*PullThroughCacheRule, error)

	// ValidatePullThroughCacheRule validates a pull-through cache rule by prefix.
	ValidatePullThroughCacheRule(ctx context.Context, prefix string) (*ValidatePullThroughCacheRuleResult, error)

	// DeleteRegistryPolicy deletes the registry-level policy.
	DeleteRegistryPolicy(ctx context.Context) (*RegistryPolicyResult, error)

	// DescribeRegistry returns registry-wide metadata.
	DescribeRegistry(ctx context.Context) (*RegistryDescription, error)

	// GetRegistryPolicy returns the registry-level policy.
	GetRegistryPolicy(ctx context.Context) (*RegistryPolicyResult, error)

	// GetRegistryScanningConfiguration returns the registry scanning configuration.
	GetRegistryScanningConfiguration(ctx context.Context) (*RegistryScanningSettings, error)

	// PutRegistryPolicy creates or replaces the registry-level IAM policy.
	PutRegistryPolicy(ctx context.Context, policyText string) (*RegistryPolicyResult, error)

	// PutRegistryScanningConfiguration updates the registry scanning configuration.
	PutRegistryScanningConfiguration(
		ctx context.Context,
		settings *RegistryScanningSettings,
	) (*RegistryScanningSettings, error)

	// PutReplicationConfiguration updates the registry replication configuration.
	PutReplicationConfiguration(ctx context.Context, cfg *ReplicationConfig) (*ReplicationConfig, error)

	// GetRepositoryPolicy returns the repository-level policy.
	GetRepositoryPolicy(ctx context.Context, repositoryName string) (*RepositoryPolicyResult, error)

	// SetRepositoryPolicy creates or replaces the repository-level IAM policy.
	SetRepositoryPolicy(ctx context.Context, repositoryName, policyText string) (*RepositoryPolicyResult, error)

	// DeleteRepositoryPolicy deletes the repository-level policy.
	DeleteRepositoryPolicy(ctx context.Context, repositoryName string) (*RepositoryPolicyResult, error)

	// GetSigningConfiguration returns the current registry signing configuration.
	GetSigningConfiguration(ctx context.Context) (*SigningSettings, error)

	// PutSigningConfiguration updates the registry signing configuration.
	PutSigningConfiguration(ctx context.Context, settings *SigningSettings) (*SigningSettings, error)

	// DeleteSigningConfiguration removes the registry signing configuration.
	DeleteSigningConfiguration(ctx context.Context) (*SigningSettings, error)

	// DescribeImageSigningStatus returns signing status for an image.
	DescribeImageSigningStatus(
		ctx context.Context,
		repositoryName string,
		imageID ImageIdentifier,
	) (*ImageSigningStatusResult, error)

	// DescribeImageScanFindings returns scan findings for an image.
	DescribeImageScanFindings(
		ctx context.Context,
		repositoryName string,
		imageID ImageIdentifier,
		maxResults int,
		nextToken string,
	) (*ImageScanFindingsResult, string, error)

	// StartImageScan starts an image scan and returns the scan status.
	StartImageScan(ctx context.Context, repositoryName string, imageID ImageIdentifier) (*ImageScanStartResult, error)

	// ListImages lists image identifiers for a repository.
	// tagStatusFilter can be "TAGGED", "UNTAGGED", or "" / "ANY" for all images.
	ListImages(ctx context.Context, repositoryName, tagStatusFilter string) ([]ImageIdentifier, error)

	// ListImageReferrers lists image referrers for a subject image.
	ListImageReferrers(ctx context.Context, repositoryName string, subject ImageIdentifier) ([]ImageReferrer, error)

	// PutImage creates or replaces an image manifest.
	PutImage(ctx context.Context, repositoryName string, image Image) (*Image, error)

	// PutImageScanningConfiguration updates per-repository scan-on-push config.
	PutImageScanningConfiguration(
		ctx context.Context,
		repositoryName string,
		scanOnPush bool,
	) (*RepositoryScanningConfiguration, error)

	// PutImageTagMutability updates per-repository tag mutability.
	PutImageTagMutability(
		ctx context.Context,
		repositoryName, imageTagMutability string,
		exclusionFilters []ImageTagMutabilityExclusionFilter,
	) (*Repository, error)

	// DescribeImageReplicationStatus returns the current replication status for an image.
	DescribeImageReplicationStatus(
		ctx context.Context,
		repositoryName string,
		imageID ImageIdentifier,
	) (*ImageReplicationStatusResult, error)

	// UpdateImageStorageClass updates the storage class for an image.
	UpdateImageStorageClass(
		ctx context.Context,
		repositoryName string,
		imageID ImageIdentifier,
		target string,
	) (*ImageStorageClassResult, error)

	// GetAccountSetting returns a registry account setting.
	GetAccountSetting(ctx context.Context, name string) (string, error)

	// PutAccountSetting updates a registry account setting.
	PutAccountSetting(ctx context.Context, name, value string) (string, error)

	// RegisterPullTimeUpdateExclusion creates a pull time update exclusion.
	RegisterPullTimeUpdateExclusion(ctx context.Context, principalArn string) (*PullTimeUpdateExclusion, error)

	// DeregisterPullTimeUpdateExclusion deletes a pull time update exclusion.
	DeregisterPullTimeUpdateExclusion(ctx context.Context, principalArn string) (*PullTimeUpdateExclusion, error)

	// ListPullTimeUpdateExclusions lists pull time update exclusions.
	ListPullTimeUpdateExclusions(ctx context.Context) ([]PullTimeUpdateExclusion, error)

	// UpdateRepositoryCreationTemplate updates a repository creation template.
	UpdateRepositoryCreationTemplate(
		ctx context.Context,
		req *RepositoryCreationTemplate,
	) (*RepositoryCreationTemplate, error)

	// TagResource associates tags with a resource identified by ARN.
	TagResource(ctx context.Context, resourceArn string, tags map[string]string) error

	// UntagResource removes tags from a resource identified by ARN.
	UntagResource(ctx context.Context, resourceArn string, tagKeys []string) error

	// ListTagsForResource returns all tags for a resource identified by ARN.
	ListTagsForResource(ctx context.Context, resourceArn string) (map[string]string, error)

	// Reset clears all backend state.
	Reset()

	// Region returns the AWS region this backend is configured for.
	Region() string

	// AccountID returns the AWS account ID associated with this registry.
	AccountID() string
}

Backend defines the interface for ECR control-plane operations. InMemoryBackend implements this interface; alternative backends (e.g. one that delegates to a real Docker daemon registry, or a test double) can implement it too, keeping the Handler backend-agnostic.

Data-plane methods take a context.Context as their first argument so that per-request metadata (notably the AWS region, via pkgs/awsmeta) can flow through to ARN construction and region-scoped behaviour.

type CVSSScore 

type CVSSScore struct {
	ScoringVector string  `json:"scoringVector,omitempty"`
	Source        string  `json:"source,omitempty"`
	Version       string  `json:"version,omitempty"`
	BaseScore     float64 `json:"baseScore,omitempty"`
}

CVSSScore is a single CVSS scoring entry for an enhanced finding.

type CompleteLayerUploadResult 

type CompleteLayerUploadResult struct {
	LayerDigest    string `json:"layerDigest"`
	RepositoryName string `json:"repositoryName"`
	RegistryID     string `json:"registryId"`
	UploadID       string `json:"uploadId"`
}

CompleteLayerUploadResult is the result of a layer upload completion.

type EnhancedFindingResource 

type EnhancedFindingResource struct {
	ID      string                         `json:"id,omitempty"`
	Type    string                         `json:"type,omitempty"`
	Details EnhancedFindingResourceDetails `json:"details"`
}

EnhancedFindingResource identifies the resource an enhanced finding applies to.

type EnhancedFindingResourceDetails 

type EnhancedFindingResourceDetails struct {
	AwsEcrContainerImage AwsEcrContainerImageDetails `json:"awsEcrContainerImage"`
}

EnhancedFindingResourceDetails wraps the resource-type-specific detail.

type EnhancedImageScanFinding 

type EnhancedImageScanFinding struct {
	PackageVulnerabilityDetails *PackageVulnerabilityDetails `json:"packageVulnerabilityDetails,omitempty"`
	Remediation                 *Remediation                 `json:"remediation,omitempty"`
	Description                 string                       `json:"description,omitempty"`
	AwsAccountID                string                       `json:"awsAccountId,omitempty"`
	FindingArn                  string                       `json:"findingArn,omitempty"`
	Severity                    string                       `json:"severity,omitempty"`
	Status                      string                       `json:"status,omitempty"`
	Title                       string                       `json:"title,omitempty"`
	Type                        string                       `json:"type,omitempty"`
	FixAvailable                string                       `json:"fixAvailable,omitempty"`
	Resources                   []EnhancedFindingResource    `json:"resources,omitempty"`
	UpdatedAt                   float64                      `json:"updatedAt"`
	LastObservedAt              float64                      `json:"lastObservedAt"`
	FirstObservedAt             float64                      `json:"firstObservedAt"`
	Score                       float64                      `json:"score,omitempty"`
}

EnhancedImageScanFinding is an Inspector-style enhanced scan finding, returned under enhancedFindings when the registry uses ENHANCED scanning. It carries package-level vulnerability detail that the BASIC finding shape lacks.

type Handler 

type Handler struct {
	Backend Backend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for ECR operations.

func NewHandler 

func NewHandler(backend Backend, registryHandler http.Handler) *Handler

NewHandler creates a new ECR handler. registryHandler may be nil when the local registry is disabled.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this ECR instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the ECR action from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the repository name from the request. For registry v2 paths (/v2/<name>/...) the name is taken from the URL to avoid buffering potentially large binary upload bodies.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported ECR operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for ECR requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for ECR. Control plane uses header-exact priority; registry uses path-based priority elevated above catch-alls.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RegistryEnabled 

func (h *Handler) RegistryEnabled() bool

RegistryEnabled returns true if the embedded Docker registry is enabled.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears the backend state and resets the endpoint lazy-init.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend when it implements Snapshottable. Non-snapshottable backends are skipped.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches ECR requests. It matches on:

  • X-Amz-Target header with AmazonEC2ContainerRegistry_V20150921. prefix (control plane)
  • /v2 or /v2/ path prefix (Docker registry v2 API, when local registry is enabled)

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend when it implements Snapshottable. Returns nil for non-snapshottable backends.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if one is configured. It satisfies the service.BackgroundWorker interface.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval time.Duration, taskTimeout ...time.Duration) *Handler

WithJanitor attaches a background lifecycle-expiry janitor to the handler. interval=0 uses the default of one minute. The optional taskTimeout bounds each sweep; 0 means no per-task timeout. It is a no-op unless the backend is an *InMemoryBackend.

type Image 

type Image struct {
	ImagePushedAt          time.Time                     `json:"imagePushedAt"`
	LastActivatedAt        time.Time                     `json:"lastActivatedAt"`
	LastArchivedAt         time.Time                     `json:"lastArchivedAt"`
	LastRecordedPullTime   time.Time                     `json:"lastRecordedPullTime"`
	ScanFindingsSummary    *ImageScanFindingsSummaryInfo `json:"-"`
	ScanStatus             *ImageScanStatusInfo          `json:"-"`
	ImageID                ImageIdentifier               `json:"imageId"`
	ImageDigest            string                        `json:"imageDigest"`
	ImageManifest          string                        `json:"imageManifest,omitempty"`
	ImageManifestMediaType string                        `json:"imageManifestMediaType,omitempty"`
	ImageStatus            string                        `json:"imageStatus,omitempty"`
	RepositoryName         string                        `json:"repositoryName"`
	RegistryID             string                        `json:"registryId"`
	StorageClass           string                        `json:"storageClass,omitempty"`
	Tags                   []string                      `json:"-"`
	ImageSizeInBytes       int64                         `json:"imageSizeInBytes,omitempty"`
}

Image represents a Docker image in ECR.

LastActivatedAt, LastArchivedAt, and LastRecordedPullTime back DescribeImages' ImageDetail.lastActivatedAt/lastArchivedAt/ lastRecordedPullTime fields (see toImageDetailView): they are set by UpdateImageStorageClass (activate/archive transitions) and by BatchGetImage/GetDownloadUrlForLayer (pull recording) respectively. Being plain fields on Image, they are automatically cascade-deleted with the image and automatically included in Snapshot/Restore -- no separate map to manage.

ScanFindingsSummary and ScanStatus are transient, request-scoped annotations (never persisted, mirroring the Tags field below): DescribeImages populates them fresh from the imageScanFindings store on each call so toImageDetailView can surface imageScanFindingsSummary/imageScanStatus.

type ImageFailure 

type ImageFailure struct {
	ImageID       ImageIdentifier `json:"imageId"`
	FailureCode   string          `json:"failureCode"`
	FailureReason string          `json:"failureReason"`
}

ImageFailure represents an image that could not be processed.

type ImageIdentifier 

type ImageIdentifier struct {
	ImageDigest string `json:"imageDigest,omitempty"`
	ImageTag    string `json:"imageTag,omitempty"`
}

ImageIdentifier identifies a specific image by digest or tag.

type ImageReferrer 

type ImageReferrer struct {
	Annotations    map[string]string `json:"annotations,omitempty"`
	Digest         string            `json:"digest,omitempty"`
	MediaType      string            `json:"mediaType,omitempty"`
	ArtifactStatus string            `json:"artifactStatus,omitempty"`
	ArtifactType   string            `json:"artifactType,omitempty"`
	Size           int64             `json:"size,omitempty"`
}

ImageReferrer is an OCI referrer summary.

type ImageReplicationStatusEntry 

type ImageReplicationStatusEntry struct {
	Region        string `json:"region,omitempty"`
	RegistryID    string `json:"registryId,omitempty"`
	Status        string `json:"status"`
	FailureCode   string `json:"failureCode,omitempty"`
	FailureReason string `json:"failureReason,omitempty"`
}

ImageReplicationStatusEntry is the replication status for a single destination.

type ImageReplicationStatusResult 

type ImageReplicationStatusResult struct {
	ImageID             ImageIdentifier               `json:"imageId"`
	RepositoryName      string                        `json:"repositoryName"`
	ReplicationStatuses []ImageReplicationStatusEntry `json:"replicationStatuses"`
}

ImageReplicationStatusResult stores image replication status.

type ImageScanFinding 

type ImageScanFinding struct {
	Attributes  map[string]string `json:"attributes,omitempty"`
	Description string            `json:"description,omitempty"`
	Name        string            `json:"name,omitempty"`
	Severity    string            `json:"severity,omitempty"`
	URI         string            `json:"uri,omitempty"`
}

ImageScanFinding is an image scan finding.

type ImageScanFindingsResult 

type ImageScanFindingsResult struct {
	FindingSeverityCounts map[string]int32   `json:"findingSeverityCounts,omitempty"`
	ImageID               ImageIdentifier    `json:"imageId"`
	RepositoryName        string             `json:"repositoryName"`
	RegistryID            string             `json:"registryId"`
	Status                string             `json:"status"`
	Description           string             `json:"description"`
	Findings              []ImageScanFinding `json:"findings,omitempty"`
	// EnhancedFindings carries Inspector-style, package-level findings produced by
	// ENHANCED registry scanning. It is empty for BASIC scans, which populate
	// Findings instead — so the two scan types return genuinely different shapes.
	EnhancedFindings             []EnhancedImageScanFinding `json:"enhancedFindings,omitempty"`
	ImageScanCompletedAt         float64                    `json:"imageScanCompletedAt"`
	VulnerabilitySourceUpdatedAt float64                    `json:"vulnerabilitySourceUpdatedAt,omitempty"`
}

ImageScanFindingsResult stores scan findings for an image.

ImageScanCompletedAt and VulnerabilitySourceUpdatedAt are epoch-seconds numbers (float64), matching the real ECR wire shape: the SDK deserializer (awsAwsjson11_deserializeDocumentImageScanFindings) parses both as smithytime.ParseEpochSeconds(json.Number), and the real field name is "imageScanCompletedAt" — not "completedAt".

type ImageScanFindingsSummaryInfo added in v1.2.0 

type ImageScanFindingsSummaryInfo struct {
	FindingSeverityCounts        map[string]int32
	ImageScanCompletedAt         float64
	VulnerabilitySourceUpdatedAt float64
}

ImageScanFindingsSummaryInfo carries the per-image scan findings summary used to populate DescribeImages' imageScanFindingsSummary field. It is annotated onto Image transiently (see Image.ScanFindingsSummary) and mirrors the subset of ImageScanFindingsResult that the real ImageScanFindingsSummary wire shape exposes.

type ImageScanStartResult 

type ImageScanStartResult struct {
	ImageID        ImageIdentifier `json:"imageId"`
	RepositoryName string          `json:"repositoryName"`
	RegistryID     string          `json:"registryId"`
	Status         string          `json:"status"`
	Description    string          `json:"description"`
}

ImageScanStartResult is returned by StartImageScan.

type ImageScanStatusInfo added in v1.2.0 

type ImageScanStatusInfo struct {
	Status      string
	Description string
}

ImageScanStatusInfo carries the per-image scan status used to populate DescribeImages' imageScanStatus field. It is annotated onto Image transiently (see Image.ScanStatus).

type ImageSigningStatusRecord 

type ImageSigningStatusRecord struct {
	FailureCode       string `json:"failureCode,omitempty"`
	FailureReason     string `json:"failureReason,omitempty"`
	SigningProfileArn string `json:"signingProfileArn,omitempty"`
	Status            string `json:"status"`
}

ImageSigningStatusRecord is a signing status entry.

type ImageSigningStatusResult 

type ImageSigningStatusResult struct {
	ImageID         ImageIdentifier            `json:"imageId"`
	RegistryID      string                     `json:"registryId"`
	RepositoryName  string                     `json:"repositoryName"`
	SigningStatuses []ImageSigningStatusRecord `json:"signingStatuses"`
}

ImageSigningStatusResult stores signing status for an image.

type ImageStorageClassResult 

type ImageStorageClassResult struct {
	ImageID        ImageIdentifier `json:"imageId"`
	ImageStatus    string          `json:"imageStatus"`
	RegistryID     string          `json:"registryId"`
	RepositoryName string          `json:"repositoryName"`
}

ImageStorageClassResult stores the image status after storage class updates.

type ImageTagMutabilityExclusionFilter 

type ImageTagMutabilityExclusionFilter struct {
	Filter     string `json:"filter,omitempty"`
	FilterType string `json:"filterType,omitempty"`
}

ImageTagMutabilityExclusionFilter configures tag mutability exceptions.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend stores ECR repository state in memory.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region, endpoint string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with the given account ID and region.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID associated with this registry.

func (*InMemoryBackend) AddImageInternal 

func (b *InMemoryBackend) AddImageInternal(repositoryName string, img Image)

AddImageInternal seeds an image directly into the backend for testing. repositoryName is the repository to add the image to; img is the image to add.

func (*InMemoryBackend) AddLifecyclePolicyInternal 

func (b *InMemoryBackend) AddLifecyclePolicyInternal(repositoryName, policy string)

AddLifecyclePolicyInternal seeds a lifecycle policy directly into the backend for testing.

func (*InMemoryBackend) AddRepositoryInternal 

func (b *InMemoryBackend) AddRepositoryInternal(repo Repository)

AddRepositoryInternal seeds a repository directly into the backend for testing.

func (*InMemoryBackend) BatchCheckLayerAvailability 

func (b *InMemoryBackend) BatchCheckLayerAvailability(
	ctx context.Context,
	repositoryName string,
	layerDigests []string,
) ([]LayerAvailability, []LayerFailure, error)

BatchCheckLayerAvailability checks the availability of image layers in a repository.

func (*InMemoryBackend) BatchDeleteImage 

func (b *InMemoryBackend) BatchDeleteImage(ctx context.Context,
	repositoryName string,
	imageIDs []ImageIdentifier,
) ([]ImageIdentifier, []ImageFailure, error)

BatchDeleteImage deletes the specified images from a repository. When deleting by digest, all associated tags are removed and the image is deleted. When deleting by tag, only that tag binding is removed; the image remains accessible by digest (it becomes untagged if it had no other tags).

func (*InMemoryBackend) BatchGetImage 

func (b *InMemoryBackend) BatchGetImage(ctx context.Context,
	repositoryName string,
	imageIDs []ImageIdentifier,
) ([]Image, []ImageFailure, error)

BatchGetImage retrieves details for the specified images. Fetching an image's manifest this way is how a client pulls it, so this also stamps lastRecordedPullTime (surfaced via DescribeImages) on every found image.

func (*InMemoryBackend) BatchGetRepositoryScanningConfiguration 

func (b *InMemoryBackend) BatchGetRepositoryScanningConfiguration(
	ctx context.Context,
	repositoryNames []string,
) ([]RepositoryScanningConfiguration, []RepositoryScanningConfigurationFailure, error)

BatchGetRepositoryScanningConfiguration returns scanning configuration for repositories.

func (*InMemoryBackend) CompleteLayerUpload 

func (b *InMemoryBackend) CompleteLayerUpload(
	ctx context.Context,
	repositoryName, uploadID string,
	layerDigests []string,
) (*CompleteLayerUploadResult, error)

CompleteLayerUpload finalises the upload of an image layer. It requires a live InitiateLayerUpload session (see resolveCompletedLayerLocked for the full set of preconditions AWS enforces) and computes the SHA256 of the accumulated bytes, verifying it against any caller-supplied full-length digest.

func (*InMemoryBackend) CreatePullThroughCacheRule 

func (b *InMemoryBackend) CreatePullThroughCacheRule(
	ctx context.Context,
	prefix, upstreamURL, credentialArn, upstreamRegistry, customRoleArn, upstreamRepositoryPrefix string,
) (*PullThroughCacheRule, error)

CreatePullThroughCacheRule creates a new pull-through cache rule.

func (*InMemoryBackend) CreateRepository 

func (b *InMemoryBackend) CreateRepository(
	ctx context.Context,
	name, imageTagMutability string,
	scanOnPush bool,
	encryptionType, kmsKey string,
) (*Repository, error)

CreateRepository creates a new ECR repository.

func (*InMemoryBackend) CreateRepositoryCreationTemplate 

func (b *InMemoryBackend) CreateRepositoryCreationTemplate(
	ctx context.Context,
	req *RepositoryCreationTemplate,
) (*RepositoryCreationTemplate, error)

CreateRepositoryCreationTemplate creates a new repository creation template.

func (*InMemoryBackend) DeleteLifecyclePolicy 

func (b *InMemoryBackend) DeleteLifecyclePolicy(
	ctx context.Context,
	repositoryName string,
) (*LifecyclePolicyResult, error)

DeleteLifecyclePolicy deletes the lifecycle policy for a repository.

func (*InMemoryBackend) DeletePullThroughCacheRule 

func (b *InMemoryBackend) DeletePullThroughCacheRule(
	ctx context.Context,
	prefix string,
) (*PullThroughCacheRule, error)

DeletePullThroughCacheRule deletes a pull-through cache rule by prefix.

func (*InMemoryBackend) DeleteRegistryPolicy 

func (b *InMemoryBackend) DeleteRegistryPolicy(
	ctx context.Context,
) (*RegistryPolicyResult, error)

DeleteRegistryPolicy deletes the registry-level IAM policy.

func (*InMemoryBackend) DeleteRepository 

func (b *InMemoryBackend) DeleteRepository(
	ctx context.Context,
	name string,
) (*Repository, error)

DeleteRepository removes a repository by name.

func (*InMemoryBackend) DeleteRepositoryCreationTemplate 

func (b *InMemoryBackend) DeleteRepositoryCreationTemplate(
	ctx context.Context,
	prefix string,
) (*RepositoryCreationTemplate, error)

DeleteRepositoryCreationTemplate deletes a repository creation template.

func (*InMemoryBackend) DeleteRepositoryPolicy 

func (b *InMemoryBackend) DeleteRepositoryPolicy(
	ctx context.Context,
	repositoryName string,
) (*RepositoryPolicyResult, error)

DeleteRepositoryPolicy deletes the repository-level policy.

func (*InMemoryBackend) DeleteSigningConfiguration 

func (b *InMemoryBackend) DeleteSigningConfiguration(
	ctx context.Context,
) (*SigningSettings, error)

DeleteSigningConfiguration removes the registry signing configuration.

func (*InMemoryBackend) DeregisterPullTimeUpdateExclusion 

func (b *InMemoryBackend) DeregisterPullTimeUpdateExclusion(
	ctx context.Context,
	principalArn string,
) (*PullTimeUpdateExclusion, error)

DeregisterPullTimeUpdateExclusion deletes a pull time update exclusion.

func (*InMemoryBackend) DescribeImageReplicationStatus 

func (b *InMemoryBackend) DescribeImageReplicationStatus(
	ctx context.Context,
	repositoryName string,
	imageID ImageIdentifier,
) (*ImageReplicationStatusResult, error)

DescribeImageReplicationStatus returns the current replication status for an image.

func (*InMemoryBackend) DescribeImageScanFindings 

func (b *InMemoryBackend) DescribeImageScanFindings(
	ctx context.Context,
	repositoryName string,
	imageID ImageIdentifier,
	maxResults int,
	nextToken string,
) (*ImageScanFindingsResult, string, error)

DescribeImageScanFindings returns scan findings for an image.

func (*InMemoryBackend) DescribeImageSigningStatus 

func (b *InMemoryBackend) DescribeImageSigningStatus(
	ctx context.Context,
	repositoryName string,
	imageID ImageIdentifier,
) (*ImageSigningStatusResult, error)

DescribeImageSigningStatus returns signing status for an image.

func (*InMemoryBackend) DescribeImages 

func (b *InMemoryBackend) DescribeImages(
	ctx context.Context,
	repositoryName string,
	imageIDs []ImageIdentifier,
) ([]Image, error)

DescribeImages returns image details for a repository.

func (*InMemoryBackend) DescribePullThroughCacheRules 

func (b *InMemoryBackend) DescribePullThroughCacheRules(
	ctx context.Context,
	prefixes []string,
) ([]PullThroughCacheRule, error)

DescribePullThroughCacheRules lists pull-through cache rules.

func (*InMemoryBackend) DescribeRegistry 

func (b *InMemoryBackend) DescribeRegistry(
	ctx context.Context,
) (*RegistryDescription, error)

DescribeRegistry returns registry-wide metadata.

func (*InMemoryBackend) DescribeRepositories 

func (b *InMemoryBackend) DescribeRepositories(
	ctx context.Context,
	names []string,
) ([]Repository, error)

DescribeRepositories returns all repositories, optionally filtered by name.

func (*InMemoryBackend) DescribeRepositoryCreationTemplates 

func (b *InMemoryBackend) DescribeRepositoryCreationTemplates(
	ctx context.Context,
	prefixes []string,
) ([]RepositoryCreationTemplate, error)

DescribeRepositoryCreationTemplates lists repository creation templates.

func (*InMemoryBackend) GetAccountSetting 

func (b *InMemoryBackend) GetAccountSetting(
	ctx context.Context,
	name string,
) (string, error)

GetAccountSetting returns a registry account setting.

func (*InMemoryBackend) GetDownloadURLForLayer 

func (b *InMemoryBackend) GetDownloadURLForLayer(
	ctx context.Context,
	repositoryName, layerDigest string,
) (string, error)

GetDownloadURLForLayer resolves a local download URL for an uploaded layer. Resolving a layer's download URL is how a client pulls it, so this also stamps lastRecordedPullTime (surfaced via DescribeImages) on every image in the repository whose manifest references layerDigest.

func (*InMemoryBackend) GetLifecyclePolicy 

func (b *InMemoryBackend) GetLifecyclePolicy(
	ctx context.Context,
	repositoryName string,
) (*LifecyclePolicyResult, error)

GetLifecyclePolicy returns the lifecycle policy for a repository.

func (*InMemoryBackend) GetLifecyclePolicyPreview 

func (b *InMemoryBackend) GetLifecyclePolicyPreview(
	ctx context.Context,
	repositoryName string,
) (*LifecyclePolicyPreviewResult, error)

GetLifecyclePolicyPreview returns the current lifecycle policy preview.

func (*InMemoryBackend) GetRegistryPolicy 

func (b *InMemoryBackend) GetRegistryPolicy(
	ctx context.Context,
) (*RegistryPolicyResult, error)

GetRegistryPolicy returns the registry-level IAM policy.

func (*InMemoryBackend) GetRegistryScanningConfiguration 

func (b *InMemoryBackend) GetRegistryScanningConfiguration(
	ctx context.Context,
) (*RegistryScanningSettings, error)

GetRegistryScanningConfiguration returns the registry scanning configuration.

func (*InMemoryBackend) GetRepositoryPolicy 

func (b *InMemoryBackend) GetRepositoryPolicy(
	ctx context.Context,
	repositoryName string,
) (*RepositoryPolicyResult, error)

GetRepositoryPolicy returns the repository-level policy.

func (*InMemoryBackend) GetSigningConfiguration 

func (b *InMemoryBackend) GetSigningConfiguration(
	ctx context.Context,
) (*SigningSettings, error)

GetSigningConfiguration returns the current registry signing configuration.

func (*InMemoryBackend) InitiateLayerUpload 

func (b *InMemoryBackend) InitiateLayerUpload(
	ctx context.Context,
	repositoryName string,
) (*LayerUploadInitiation, error)

InitiateLayerUpload starts a layer upload session.

func (*InMemoryBackend) ListImageReferrers 

func (b *InMemoryBackend) ListImageReferrers(
	ctx context.Context,
	repositoryName string,
	subject ImageIdentifier,
) ([]ImageReferrer, error)

ListImageReferrers lists image referrers for a subject image.

func (*InMemoryBackend) ListImages 

func (b *InMemoryBackend) ListImages(
	ctx context.Context,
	repositoryName, tagStatusFilter string,
) ([]ImageIdentifier, error)

ListImages lists image identifiers for a repository. tagStatusFilter controls which images to return: "TAGGED", "UNTAGGED", or "ANY" (default).

func (*InMemoryBackend) ListPullTimeUpdateExclusions 

func (b *InMemoryBackend) ListPullTimeUpdateExclusions(
	ctx context.Context,
) ([]PullTimeUpdateExclusion, error)

ListPullTimeUpdateExclusions lists pull time update exclusions.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(
	ctx context.Context,
	resourceArn string,
) (map[string]string, error)

ListTagsForResource returns all tags for an ECR resource identified by its ARN.

func (*InMemoryBackend) ProxyEndpoint 

func (b *InMemoryBackend) ProxyEndpoint() string

ProxyEndpoint returns the registry endpoint used in repository URIs and authorization tokens. It satisfies the Backend interface.

func (*InMemoryBackend) PutAccountSetting 

func (b *InMemoryBackend) PutAccountSetting(
	ctx context.Context,
	name, value string,
) (string, error)

PutAccountSetting updates a registry account setting.

func (*InMemoryBackend) PutImage 

func (b *InMemoryBackend) PutImage(
	ctx context.Context,
	repositoryName string,
	image Image,
) (*Image, error)

func (*InMemoryBackend) PutImageScanningConfiguration 

func (b *InMemoryBackend) PutImageScanningConfiguration(
	ctx context.Context,
	repositoryName string,
	scanOnPush bool,
) (*RepositoryScanningConfiguration, error)

PutImageScanningConfiguration updates per-repository scan-on-push config.

func (*InMemoryBackend) PutImageTagMutability 

func (b *InMemoryBackend) PutImageTagMutability(
	ctx context.Context,
	repositoryName, imageTagMutability string,
	exclusionFilters []ImageTagMutabilityExclusionFilter,
) (*Repository, error)

PutImageTagMutability updates per-repository tag mutability.

func (*InMemoryBackend) PutLifecyclePolicy 

func (b *InMemoryBackend) PutLifecyclePolicy(
	ctx context.Context,
	repositoryName, policyText string,
) (*LifecyclePolicyResult, error)

PutLifecyclePolicy creates or replaces the lifecycle policy for a repository.

func (*InMemoryBackend) PutRegistryPolicy 

func (b *InMemoryBackend) PutRegistryPolicy(
	ctx context.Context,
	policyText string,
) (*RegistryPolicyResult, error)

PutRegistryPolicy creates or replaces the registry-level IAM policy.

func (*InMemoryBackend) PutRegistryScanningConfiguration 

func (b *InMemoryBackend) PutRegistryScanningConfiguration(
	ctx context.Context,
	settings *RegistryScanningSettings,
) (*RegistryScanningSettings, error)

PutRegistryScanningConfiguration updates the registry scanning configuration.

func (*InMemoryBackend) PutReplicationConfiguration 

func (b *InMemoryBackend) PutReplicationConfiguration(
	ctx context.Context,
	cfg *ReplicationConfig,
) (*ReplicationConfig, error)

PutReplicationConfiguration updates the registry replication configuration.

func (*InMemoryBackend) PutSigningConfiguration 

func (b *InMemoryBackend) PutSigningConfiguration(
	ctx context.Context,
	settings *SigningSettings,
) (*SigningSettings, error)

PutSigningConfiguration updates the registry signing configuration.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RegisterPullTimeUpdateExclusion 

func (b *InMemoryBackend) RegisterPullTimeUpdateExclusion(
	ctx context.Context,
	principalArn string,
) (*PullTimeUpdateExclusion, error)

RegisterPullTimeUpdateExclusion creates a pull time update exclusion.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state in the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RunLifecycleExpiry 

func (b *InMemoryBackend) RunLifecycleExpiry(ctx context.Context) int

RunLifecycleExpiry evaluates the lifecycle policy of every repository that has one and deletes any expired images. It is invoked by the ECR janitor on a timer so that count/age-based expirations happen in the background exactly as they do in AWS, independent of any API call. It returns the total number of images deleted across all repositories.

func (*InMemoryBackend) SetEndpoint 

func (b *InMemoryBackend) SetEndpoint(endpoint string)

SetEndpoint updates the registry endpoint used in repository URIs.

func (*InMemoryBackend) SetRegistryPolicyInternal 

func (b *InMemoryBackend) SetRegistryPolicyInternal(policy string)

SetRegistryPolicyInternal sets the registry policy directly for testing.

func (*InMemoryBackend) SetRepositoryPolicy 

func (b *InMemoryBackend) SetRepositoryPolicy(
	ctx context.Context,
	repositoryName, policyText string,
) (*RepositoryPolicyResult, error)

SetRepositoryPolicy creates or replaces the repository-level IAM policy.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StartImageScan 

func (b *InMemoryBackend) StartImageScan(ctx context.Context,
	repositoryName string,
	imageID ImageIdentifier,
) (*ImageScanStartResult, error)

StartImageScan starts an image scan and returns the scan status.

func (*InMemoryBackend) StartLifecyclePolicyPreview 

func (b *InMemoryBackend) StartLifecyclePolicyPreview(
	ctx context.Context,
	repositoryName, policyText string,
) (*LifecyclePolicyPreviewResult, error)

StartLifecyclePolicyPreview starts or refreshes a lifecycle policy preview.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(
	ctx context.Context,
	resourceArn string,
	tags map[string]string,
) error

TagResource associates tags with an ECR resource identified by its ARN.

func (*InMemoryBackend) TaggedResources added in v1.2.0 

func (b *InMemoryBackend) TaggedResources() []TaggedEntry

TaggedResources returns every ECR repository ARN that currently has at least one tag applied via TagResource.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(
	ctx context.Context,
	resourceArn string,
	tagKeys []string,
) error

UntagResource removes tags from an ECR resource identified by its ARN.

func (*InMemoryBackend) UpdateImageStorageClass 

func (b *InMemoryBackend) UpdateImageStorageClass(
	ctx context.Context,
	repositoryName string,
	imageID ImageIdentifier,
	target string,
) (*ImageStorageClassResult, error)

UpdateImageStorageClass updates the storage class for an image.

func (*InMemoryBackend) UpdatePullThroughCacheRule 

func (b *InMemoryBackend) UpdatePullThroughCacheRule(
	ctx context.Context,
	prefix, credentialArn, customRoleArn string,
) (*PullThroughCacheRule, error)

UpdatePullThroughCacheRule updates a pull-through cache rule by prefix.

func (*InMemoryBackend) UpdateRepositoryCreationTemplate 

func (b *InMemoryBackend) UpdateRepositoryCreationTemplate(
	ctx context.Context,
	req *RepositoryCreationTemplate,
) (*RepositoryCreationTemplate, error)

UpdateRepositoryCreationTemplate updates a repository creation template.

func (*InMemoryBackend) UploadLayerPart 

func (b *InMemoryBackend) UploadLayerPart(ctx context.Context,
	repositoryName, uploadID string,
	firstByte, lastByte int64,
	blob []byte,
) (*LayerUploadPartResult, error)

UploadLayerPart records uploaded bytes for an existing upload session. AWS requires each part's first byte to be consecutive to the last byte received by the previous part (i.e. equal to the number of bytes already buffered for this session); a gap or overlap is rejected with InvalidLayerPartException.

func (*InMemoryBackend) ValidatePullThroughCacheRule 

func (b *InMemoryBackend) ValidatePullThroughCacheRule(
	ctx context.Context,
	prefix string,
) (*ValidatePullThroughCacheRuleResult, error)

ValidatePullThroughCacheRule validates a pull-through cache rule by prefix.

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend
	Interval    time.Duration
	TaskTimeout time.Duration
}

Janitor is the ECR background worker. It periodically evaluates every repository's lifecycle policy and deletes images that the policy selects for expiration, mirroring the AWS ECR lifecycle evaluation job — so count- and age-based expirations happen without any API call.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a Janitor for the given backend. A zero interval falls back to the default of one minute.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce runs a single lifecycle-expiry sweep. Primarily intended for tests.

type LayerAvailability 

type LayerAvailability struct {
	LayerDigest       string `json:"layerDigest"`
	LayerAvailability string `json:"layerAvailability"`
	MediaType         string `json:"mediaType,omitempty"`
	LayerSize         int64  `json:"layerSize,omitempty"`
}

LayerAvailability represents the availability of an image layer.

type LayerFailure 

type LayerFailure struct {
	LayerDigest   string `json:"layerDigest,omitempty"`
	FailureCode   string `json:"failureCode"`
	FailureReason string `json:"failureReason"`
}

LayerFailure represents a layer that could not be checked.

type LayerUploadInitiation 

type LayerUploadInitiation struct {
	UploadID string `json:"uploadId"`
	PartSize int64  `json:"partSize"`
}

LayerUploadInitiation is returned when starting an ECR layer upload.

type LayerUploadPartResult 

type LayerUploadPartResult struct {
	RepositoryName   string `json:"repositoryName"`
	RegistryID       string `json:"registryId"`
	UploadID         string `json:"uploadId"`
	LastByteReceived int64  `json:"lastByteReceived"`
}

LayerUploadPartResult records a received layer upload part.

type LifecyclePolicyPreviewEntry added in v1.2.0 

type LifecyclePolicyPreviewEntry struct {
	ImagePushedAt       time.Time
	ImageDigest         string
	StorageClass        string
	ActionType          string
	ImageTags           []string
	AppliedRulePriority int
}

LifecyclePolicyPreviewEntry is a single per-image entry in a lifecycle policy preview (real AWS wire name: LifecyclePolicyPreviewResult; renamed here to avoid colliding with gopherstack's top-level preview-request type above).

type LifecyclePolicyPreviewResult 

type LifecyclePolicyPreviewResult struct {
	LifecyclePolicyText string
	RepositoryName      string
	RegistryID          string
	Status              string
	PreviewResults      []LifecyclePolicyPreviewEntry
}

LifecyclePolicyPreviewResult is an in-memory lifecycle preview snapshot. This is gopherstack's internal domain type (retains time.Time for internal use); the JSON wire shape is built separately by toLifecyclePolicyPreviewView so that ImagePushedAt serializes as an epoch-seconds number, matching AWS.

type LifecyclePolicyResult 

type LifecyclePolicyResult struct {
	LifecyclePolicyText string
	LastEvaluatedAt     time.Time
	RepositoryName      string
	RegistryID          string
}

LifecyclePolicyResult is the result of DeleteLifecyclePolicy, GetLifecyclePolicy, and PutLifecyclePolicy. This is gopherstack's internal domain type (retains time.Time); the JSON wire shape is built separately by toLifecyclePolicyResultView so that LastEvaluatedAt serializes as an epoch-seconds number, matching AWS.

type PackageVulnerabilityDetails 

type PackageVulnerabilityDetails struct {
	VulnerabilityID        string              `json:"vulnerabilityId,omitempty"`
	Source                 string              `json:"source,omitempty"`
	SourceURL              string              `json:"sourceUrl,omitempty"`
	VendorSeverity         string              `json:"vendorSeverity,omitempty"`
	Cvss                   []CVSSScore         `json:"cvss,omitempty"`
	ReferenceUrls          []string            `json:"referenceUrls,omitempty"`
	RelatedVulnerabilities []string            `json:"relatedVulnerabilities,omitempty"`
	VulnerablePackages     []VulnerablePackage `json:"vulnerablePackages,omitempty"`
	VendorCreatedAt        float64             `json:"vendorCreatedAt"`
}

PackageVulnerabilityDetails describes the vulnerability behind an enhanced finding, including CVSS scoring and the affected packages.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon ECR.

func (*Provider) Init 

func (p *Provider) Init(appCtx *service.AppContext) (service.Registerable, error)

Init initializes the ECR service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type PullThroughCacheRule 

type PullThroughCacheRule struct {
	CreatedAt                time.Time `json:"createdAt"`
	UpdatedAt                time.Time `json:"updatedAt"`
	EcrRepositoryPrefix      string    `json:"ecrRepositoryPrefix"`
	UpstreamRegistryURL      string    `json:"upstreamRegistryUrl"`
	CredentialArn            string    `json:"credentialArn,omitempty"`
	CustomRoleArn            string    `json:"customRoleArn,omitempty"`
	UpstreamRegistry         string    `json:"upstreamRegistry,omitempty"`
	UpstreamRepositoryPrefix string    `json:"upstreamRepositoryPrefix,omitempty"`
	RegistryID               string    `json:"registryId"`
}

PullThroughCacheRule represents a pull-through cache rule.

type PullTimeUpdateExclusion 

type PullTimeUpdateExclusion struct {
	CreatedAt    time.Time `json:"createdAt"`
	PrincipalArn string    `json:"principalArn"`
}

PullTimeUpdateExclusion is an account-level pull time exclusion.

type RegistryDescription 

type RegistryDescription struct {
	ReplicationConfiguration *ReplicationConfig `json:"replicationConfiguration,omitempty"`
	RegistryID               string             `json:"registryId"`
}

RegistryDescription stores registry-wide ECR configuration.

type RegistryPolicyResult 

type RegistryPolicyResult struct {
	PolicyText string `json:"policyText"`
	RegistryID string `json:"registryId"`
}

RegistryPolicyResult is the result of DeleteRegistryPolicy, GetRegistryPolicy, and PutRegistryPolicy. It intentionally has no "status" field: the real AWS DeleteRegistryPolicyOutput/GetRegistryPolicyOutput/PutRegistryPolicyOutput shapes carry only policyText and registryId — gopherstack previously fabricated a status string ("DELETED"/"ACTIVE"/"SetComplete") that does not exist in the real API and has been removed.

type RegistryScanningRule 

type RegistryScanningRule struct {
	ScanFrequency     string             `json:"scanFrequency,omitempty"`
	RepositoryFilters []RepositoryFilter `json:"repositoryFilters,omitempty"`
}

RegistryScanningRule is a registry scan rule.

type RegistryScanningSettings 

type RegistryScanningSettings struct {
	ScanType string                 `json:"scanType,omitempty"`
	Rules    []RegistryScanningRule `json:"rules,omitempty"`
}

RegistryScanningSettings stores registry-wide scan configuration.

type Remediation 

type Remediation struct {
	Recommendation RemediationRecommendation `json:"recommendation"`
}

Remediation carries the recommended fix for an enhanced finding.

type RemediationRecommendation 

type RemediationRecommendation struct {
	Text string `json:"text,omitempty"`
	URL  string `json:"url,omitempty"`
}

RemediationRecommendation is the human-readable remediation guidance.

type ReplicationConfig 

type ReplicationConfig struct {
	Rules []ReplicationRule `json:"rules,omitempty"`
}

ReplicationConfig stores ECR replication destinations.

type ReplicationDestination 

type ReplicationDestination struct {
	Region     string `json:"region,omitempty"`
	RegistryID string `json:"registryId,omitempty"`
}

ReplicationDestination identifies a replication target.

type ReplicationRule 

type ReplicationRule struct {
	Destinations      []ReplicationDestination `json:"destinations,omitempty"`
	RepositoryFilters []RepositoryFilter       `json:"repositoryFilters,omitempty"`
}

ReplicationRule is an ECR replication rule.

type Repository 

type Repository struct {
	CreatedAt                          time.Time                           `json:"createdAt"`
	EncryptionType                     string                              `json:"encryptionType"`
	KMSKey                             string                              `json:"kmsKey,omitempty"`
	RegistryID                         string                              `json:"registryId"`
	RepositoryARN                      string                              `json:"repositoryArn"`
	RepositoryName                     string                              `json:"repositoryName"`
	RepositoryURI                      string                              `json:"repositoryUri"`
	ImageTagMutability                 string                              `json:"imageTagMutability"`
	ImageTagMutabilityExclusionFilters []ImageTagMutabilityExclusionFilter `json:"imageTagMutabilityExclusionFilters,omitempty"` //nolint:lll // AWS-compatible JSON field name is long.
	ScanOnPush                         bool                                `json:"scanOnPush"`
}

Repository represents an ECR repository.

type RepositoryCreationTemplate 

type RepositoryCreationTemplate struct {
	CreatedAt                          time.Time                           `json:"createdAt"`
	UpdatedAt                          time.Time                           `json:"updatedAt"`
	ResourceTags                       map[string]string                   `json:"resourceTags,omitempty"`
	ImageTagMutability                 string                              `json:"imageTagMutability,omitempty"`
	EncryptionType                     string                              `json:"encryptionType,omitempty"`
	KMSKey                             string                              `json:"kmsKey,omitempty"`
	Description                        string                              `json:"description,omitempty"`
	RepositoryPolicy                   string                              `json:"repositoryPolicy,omitempty"`
	LifecyclePolicy                    string                              `json:"lifecyclePolicy,omitempty"`
	CustomRoleArn                      string                              `json:"customRoleArn,omitempty"`
	Prefix                             string                              `json:"prefix"`
	ImageTagMutabilityExclusionFilters []ImageTagMutabilityExclusionFilter `json:"imageTagMutabilityExclusionFilters,omitempty"` //nolint:lll // AWS-compatible JSON field name is long.
	AppliedFor                         []string                            `json:"appliedFor,omitempty"`
}

RepositoryCreationTemplate represents a repository creation template.

type RepositoryFilter 

type RepositoryFilter struct {
	Filter     string `json:"filter,omitempty"`
	FilterType string `json:"filterType,omitempty"`
}

RepositoryFilter is used by scanning, signing, and replication configs.

type RepositoryPolicyResult 

type RepositoryPolicyResult struct {
	PolicyText     string `json:"policyText"`
	RegistryID     string `json:"registryId"`
	RepositoryName string `json:"repositoryName"`
}

RepositoryPolicyResult stores a repository policy.

type RepositoryScanningConfiguration 

type RepositoryScanningConfiguration struct {
	RepositoryARN  string `json:"repositoryArn,omitempty"`
	RepositoryName string `json:"repositoryName"`
	ScanFrequency  string `json:"scanFrequency"`
	ScanOnPush     bool   `json:"scanOnPush"`
}

RepositoryScanningConfiguration represents scanning configuration for a repository.

type RepositoryScanningConfigurationFailure 

type RepositoryScanningConfigurationFailure struct {
	RepositoryName string `json:"repositoryName"`
	FailureCode    string `json:"failureCode"`
	FailureReason  string `json:"failureReason"`
}

RepositoryScanningConfigurationFailure represents a failure in getting scanning config.

type SigningRule 

type SigningRule struct {
	SigningProfileArn string             `json:"signingProfileArn,omitempty"`
	RepositoryFilters []RepositoryFilter `json:"repositoryFilters,omitempty"`
}

SigningRule is a registry signing rule.

type SigningSettings 

type SigningSettings struct {
	Rules []SigningRule `json:"rules,omitempty"`
}

SigningSettings stores registry signing config.

type Snapshottable 

type Snapshottable interface {
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

Snapshottable is an optional interface that a Backend may implement to support state serialisation and restoration (e.g. for --persist mode). Backends that do not implement it are silently skipped during snapshot/restore.

type TaggedEntry added in v1.2.0 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a resource ARN with its tag map, for cross-service tag enumeration by the Resource Groups Tagging API (see cli.go's wireTaggingECR).

type ValidatePullThroughCacheRuleResult 

type ValidatePullThroughCacheRuleResult struct {
	CredentialArn            string `json:"credentialArn,omitempty"`
	CustomRoleArn            string `json:"customRoleArn,omitempty"`
	EcrRepositoryPrefix      string `json:"ecrRepositoryPrefix"`
	Failure                  string `json:"failure,omitempty"`
	RegistryID               string `json:"registryId"`
	UpstreamRegistryURL      string `json:"upstreamRegistryUrl,omitempty"`
	UpstreamRepositoryPrefix string `json:"upstreamRepositoryPrefix,omitempty"`
	IsValid                  bool   `json:"isValid"`
}

ValidatePullThroughCacheRuleResult is returned by ValidatePullThroughCacheRule.

type VulnerablePackage 

type VulnerablePackage struct {
	Arch            string `json:"arch,omitempty"`
	FilePath        string `json:"filePath,omitempty"`
	Name            string `json:"name,omitempty"`
	PackageManager  string `json:"packageManager,omitempty"`
	Release         string `json:"release,omitempty"`
	SourceLayerHash string `json:"sourceLayerHash,omitempty"`
	Version         string `json:"version,omitempty"`
	FixedInVersion  string `json:"fixedInVersion,omitempty"`
	Remediation     string `json:"remediation,omitempty"`
	Epoch           int    `json:"epoch,omitempty"`
}

VulnerablePackage describes an individual affected package in an enhanced finding.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.