Docker推送到AWS ECR私有仓库失败,格式错误的JSON

Question

我正在尝试AWS ECR并将新标签推送到我们的私人存储库.

它是这样的:

export DOCKER_REGISTRY=0123123123123.dkr.ecr.us-east-1.amazonaws.com
export TAG=0.1
docker build -t vendor/app-name .
`aws ecr get-login --region us-east-1`" # generates docker login
docker tag vendor/app-name $DOCKER_REGISTRY/vendor/app-name:$TAG
docker push $DOCKER_REGISTRY/vendor/app-name:$TAG

登录工作,标签被创建,我看到它docker images,但推送失败失败.

The push refers to a repository [0123123123123.dkr.ecr.us-east-1.amazonaws.com/vendor/app-name] (len: 2)
b1a1d76b9e52: Pushing [==================================================>]     32 B/32 B
Error parsing HTTP response: unexpected end of JSON input: ""

这很可能是一个配置错误,但我无法弄清楚如何从中获得更多的输出.该命令没有调试级别选项,没有其他日志,我无法拦截网络流量,因为它似乎是加密的.

Answer 1

陷入同样的​​问题.对我来说,确保我正在推动的IAM用户有ecr:BatchCheckLayerAvailability权限清除了这一点.

我原本打算采用"仅推送"策略,并没有意识到需要成功推送此权限.

Answer 2

您需要的最低政策：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": "ecr:GetAuthorizationToken",
      "Resource": "*"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
        "ecr:UploadLayerPart",
        "ecr:PutImage",
        "ecr:InitiateLayerUpload",
        "ecr:CompleteLayerUpload",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "arn:aws:ecr:<your region>:<your account id>:repository/<your repository name>"
    }
  ]
}