emindco/ecr-cleaner repository overview

⁠Usage

Run the following from an EC2 machine with IAM permissions which allow deleting images on ECR:

docker run --rm emindco/ecr-cleaner region repository_name images_to_keep [--delete-untagged] [--dry-run]

• region is an AWS region (e.g. 'us-east-1')
• repository_name is an AWS ECR repository (e.g. 'company/repo_name')
• images_to_keep is the number of images to keep (e.g. '100')

If you specify --delete-untagged, any untagged image in the given repository will be deleted.

You can perform a test run without actually deleting any images by specifying the --dry-run argument.

⁠How does it work?

The image contains a Python script which uses boto3⁠ to communicate with ECR. The script retrieves the current list of existing images on the given repository, sorts them (see below) by image tag and then deletes images from the beginning of the list, leaving the number of images specified in the images_to_keep argument.

⁠Sorting

The script sorts the images by image tag in a way humans expect, for example:

• 1
• 2
• 3
• 10
• 11
• build1
• build2
• whatever

So, if we ran the utility with images_to_keep set to 4, we will be left with the following after the run:

• 11
• build1
• build2
• whatever

This should work fine for you if your CI/CD process uses some kind of auto-incrementing naming convention for the builds. If, on the other hand, you tag your images with random stuff like commit SHAs etc., do NOT use this utility since it will delete random images.

The script skips images with the latest tag and will never delete them, regardless the specified arguments.

⁠TODO

• Find old images based on creation time instead of tags.
• Add a way for specifying AWS credentials (environment variables).