---
# System prepended metadata

title: Handling docker images in CDK/Spaceport

---

# Handling docker images in CDK/Spaceport

**Goals**
- Payload is source of truth
  - Image is there first, and is always there for every build (retention policies TBD)
  - These are the images we scan
  - All other images are copies
- Images should only be in ECR if they are being deployed CDK deploy
  - Every build should not be replicated everywhere before/during synthesis
- Use Kaniko to build
---

**Current Idea**

Create bucket/ECR in ops account that acts as a staging area for the rest of the accounts
jenkins builds and pushes to BOTH Payload and this staging area. 
During synth, pass URI (pointing to staging area) as source in ECRDeployment.
During deploy, ECRDeployment copies from staging area to target ECR
- Only 2 layers of duplications (Payload + staging area + target ECRs)
- No networking issues (except cost, I guess, since this will be going through internet)
- Can use IAM (I think? Does this work cross partition?)

---

**Considering**

1. (PRE SYNTH) Kaniko builds image, pushes to Payload and outputs tarball locally
2. (SYNTH) CDK stores tarball as a staged file asset. This is stored in the NPM package.
3. (DEPLOY) CDK pushes tarball to S3 as an asset, then ECRDeployment custom resource copies asset from S3 to ECR.

**PROS**
- Guaranteed and consistent availability of images
- Easiest to implement

**CONS**
- Deploy includes the time it takes to copy the image **twice** (local Cloud Assembly -> S3 Asset -> ECR)
- Multiple levels of duplication
  - Image in Payload
  - Image (as tarball) in CDK asset in Payload, **per stage**
  - Image (as tarball) in S3, **per stage**
  - Image in ECR, **per stage**

===

Expose subset of Payload to internet
jenkins builds and pushes to Payload only. 
During synth, pass URI (pointing to payload) as source in ECRDeployment.
During deploy, ECRDeployment copies from Payload to target ECR
- No bad duplication!
- ?? Need to figure out auth

===

### New favorite

power-container-service creates ECRs upfront
During deployment pipeline, but before CDK deploy, Jenkins copies image to target ECR (using [crane](https://github.com/google/go-containerregistry/tree/main/cmd/crane))
container image is passed in as a deploy-time parameter

- No bad duplication!
- No ECRDeployment (lighterweight)
- Fastest option, medium amount of effort
- First use of deploy-time parameters (regular CFN params)
- Multiple moving pieces (Repo backing service, Jenkins copying, CDK)
  - Deployment is no longer "Just CDK"



---

---

**Ruled out**

**(WOULD HAVE TO PUSH TO ALL ACCOUNTS UPFRONT, PRETTY WASTEFUL AND COMPLICATED)**
power-container-service creates ECRs upfront
jenkins builds and pushes to BOTH Payload and ECR, passes repo/tag in as ENV context
- Should be possible to limit ECR retention

===

**(REPLICATION IS ONLY A BETWEEN BETWEEN ARTIFACTORY SERVERS)**
Only push to payload, but setup payload to replicate to ECR all accounts

===

**(NOT SUPPORTED IN GOVCLOUD)**
Every account has a "pull-through cache" of Payload
- Emphasizes that ECR is not a source of truth
- Can be added in power-container-service
- Must allow ECR in every account to talk to Payload (possible?)

===

**(NOT SUPPORTED IN GOVCLOUD)**
Use ECR cross-account replication
