How to pull images from AWS ECR via pull through cache in .gitlab-ci

Question

I'm using a gitlab pipeline, where its base image repo is in AWS ECR. I've configured AWS ECR pull through cache where my upstream registry is docker hub.

In my runners, I've added this

          [[runners]]
            [runners.kubernetes]
              pull_policy = ["if-not-present", "always"]

and my .gitlab-ci.yaml is,

default:
  tags: 
      - my-custom-runner

stages:
  - test-pull

check_ecr_repo:
  image: 
    name: 12345678920.dkr.ecr.eu-west-2.amazonaws.com/docker-hub/library/alpine:3.10.1
    pull_policy: always
  stage: test-pull
  script:
    - echo "Image is pulled - test cache"

My expectation is that when the pipeline is run, it should pull the image from the upstream registry to the ECR repo since I've configured the pull through cache.

But I notice that the image from docker-hub is not being pulled to my ECR Repo, and the pipeline fails saying the image is not present. And yes the image is not present because it should pull from the docker hub as the pull through cache is configured.

NOTE: My runner has full access to the AWS account. (The pipeline works fine if the image is present in the ECR repo, which means the runner has access to the ECR repo)

When I run this locally it pulls the image to the ECR repo from the upstream registry (docker hub).

docker pull 12345678920.dkr.ecr.eu-west-2.amazonaws.com/docker-hub/library/alpine:3.10.1

From your configurations that you're using kubernetes executor, do your nodes have access to the ecr ? — Saleh
– Saleh, Commented Sep 25 at 18:32

Shiran Joseph · Accepted Answer · 2025-09-25 21:34:55Z

1

I found the answer for this

Had to allow this permission for the EKS node IAM role

ecr:BatchImportUpstreamImage

answered Sep 25 at 21:34

Shiran Joseph

213 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Community Sep 25 at 22:18

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.

Collectives™ on Stack Overflow

How to pull images from AWS ECR via pull through cache in .gitlab-ci

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related