Docker Engine daemon.json: Proxy Bypass for Private ECR and S3

Account for S3 layer downloads when bypassing an HTTP proxy for private ECR image pulls through VPC endpoints.

A successful connection to a private ECR registry does not complete an image pull. ECR supplies the manifest, while Amazon S3 stores the image layers. A proxy bypass that covers only the registry can therefore leave the layer download taking a different route.

For private access through VPC endpoints, check both paths:

  • The ECR interface endpoint and its private DNS configuration.
  • The S3 endpoint, its associated route tables, and the policy allowing access to ECR’s layer bucket.

Then put the relevant bypass names on the process performing the pull. For a native Docker Engine with an existing daemon.json proxy configuration, an illustrative us-east-2 configuration is:

{
  "proxies": {
    "http-proxy": "http://proxy.example:8080",
    "https-proxy": "http://proxy.example:8080",
    "no-proxy": "123456789012.dkr.ecr.us-east-2.amazonaws.com,prod-us-east-2-starport-layer-bucket.s3.us-east-2.amazonaws.com"
  }
}

Merge the intended entries with the daemon’s other settings and existing bypass list. If other public registry downloads may use a public intermediary, the HTTP proxy list supplies candidates for the no-account proxy URLs; preserve the private ECR and S3 bypasses. Replace the account, region and layer-download hostname with the names actually used by the pull. S3 naming forms and endpoint configurations can differ; this example is not an exhaustive AWS endpoint list. Applying daemon configuration requires the intended daemon restart. Docker Desktop uses its own proxy settings.

A bypass chooses a direct route. It cannot create a missing S3 endpoint, attach a route table, grant bucket access or repair private DNS. Confirm those dependencies before extending the bypass to broad AWS domains.

The Docker client’s container-proxy settings do not configure the daemon’s image downloads. Likewise, an AWS CLI command obtaining ECR login credentials has its own proxy configuration; include its API destination if that separate request also needs private access.

Ũhoro ũhĩtĩte