Amazon ECR

Manage private repository records, layer uploads and image manifests through the ECR API.

Plan: Pro58 of 58 operations implemented

Docker login, push and pull weren't verified. The returned repository and layer URLs aren't the shared API endpoint.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Activate your license key and start the emulator with the Vera launcher, as in Activate Pro, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

Use the AWS CLI’s ecr commands. The emulator serves the 2015-09-21 API over the AWS JSON protocol, and the examples use us-east-1.

A repository URI looks like AWS’s, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/vera-docs-private, and a layer’s download URL starts with https://ecr.local/. They name things in the emulator: they aren’t its endpoint, so keep sending requests to $VERA_ENDPOINT. Pointing Docker at them wasn’t tested.

Example

Create a private repository:

aws --endpoint-url "$VERA_ENDPOINT" ecr create-repository --repository-name vera-docs-private

These are selected fields from the output. The account is the one configured on your instance:

{
  "repository": {
    "repositoryArn": "arn:aws:ecr:us-east-1:123456789012:repository/vera-docs-private",
    "registryId": "123456789012",
    "repositoryName": "vera-docs-private",
    "repositoryUri": "123456789012.dkr.ecr.us-east-1.amazonaws.com/vera-docs-private"
  }
}

Read the repository back and list its images:

aws --endpoint-url "$VERA_ENDPOINT" ecr describe-repositories --repository-names vera-docs-private
aws --endpoint-url "$VERA_ENDPOINT" ecr list-images --repository-name vera-docs-private

To clean up, delete the repository. --force deletes it along with any images in it:

aws --endpoint-url "$VERA_ENDPOINT" ecr delete-repository --repository-name vera-docs-private --force

Supported features

Private repositories: create, describe, list images and delete with --force.
Layer uploads. In a separate check, InitiateLayerUpload, a one-part UploadLayerPart and CompleteLayerUpload with the layer’s SHA-256 digest stored a layer, and BatchCheckLayerAvailability reported it AVAILABLE.
Image manifests: a manifest was put with PutImage, described, fetched with BatchGetImage and deleted with BatchDeleteImage.
Layer download URLs. Once a manifest referenced the uploaded layer, GetDownloadUrlForLayer returned a URL beginning https://ecr.local/123456789012/. The URL wasn’t fetched. As on AWS, asking for a layer no image references yet answers LayerInaccessibleException.
Image scan records: StartImageScan and DescribeImageScanFindings, with the limits below.
Listed in the earlier implementation inventory; not rechecked since: lifecycle policies and previews, pull-through cache rules, replication, repository creation templates, registry and repository policies, scanning and signing configuration, tag mutability, authorization tokens and tags.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

Docker use wasn’t verified. Docker login, push and pull weren’t tried, and no repository URI or layer download URL was contacted. The layer and manifest calls stored metadata, and no image was run from them.
Don’t rely on image scans. A started scan was COMPLETE at once, with empty findings. No vulnerability scanner was validated, so a scan’s status and findings say nothing about the image.
Upload limits weren’t tested. Only a small one-part layer was uploaded, so part sizes and corrupted uploads weren’t checked.

API coverage

Every operation in AWS's published 2015-09-21 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
BatchCheckLayerAvailability	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — reported the uploaded layer `AVAILABLE`.
BatchDeleteImage	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — deleted the stored manifest.
BatchGetImage	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — fetched the stored manifest.
BatchGetRepositoryScanningConfiguration	Implemented
CompleteLayerUpload	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — completed the upload with the layer's SHA-256 digest.
CreatePullThroughCacheRule	Implemented
CreateRepository	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — created the example's repository, with a repository URI on `dkr.ecr.us-east-1.amazonaws.com` that names it but isn't the emulator's endpoint.
CreateRepositoryCreationTemplate	Implemented
DeleteLifecyclePolicy	Implemented
DeletePullThroughCacheRule	Implemented
DeleteRegistryPolicy	Implemented
DeleteRepository	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — deleted the example's repository with `--force`.
DeleteRepositoryCreationTemplate	Implemented
DeleteRepositoryPolicy	Implemented
DeleteSigningConfiguration	Implemented
DeregisterPullTimeUpdateExclusion	Implemented
DescribeImageReplicationStatus	Implemented
DescribeImageScanFindings	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned a `COMPLETE` scan with empty findings straight away. No vulnerability scanner was validated.
DescribeImageSigningStatus	Implemented
DescribeImages	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — described the stored manifest.
DescribePullThroughCacheRules	Implemented
DescribeRegistry	Implemented
DescribeRepositories	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — described the example's repository.
DescribeRepositoryCreationTemplates	Implemented
GetAccountSetting	Implemented
GetAuthorizationToken	Implemented
GetDownloadUrlForLayer	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — once a manifest referenced the uploaded layer, returned a URL beginning `https://ecr.local/123456789012/`. The URL wasn't fetched, so downloading a layer and pulling an image weren't verified. Before an image referenced the layer, it answered `LayerInaccessibleException`, as AWS does.
GetLifecyclePolicy	Implemented
GetLifecyclePolicyPreview	Implemented
GetRegistryPolicy	Implemented
GetRegistryScanningConfiguration	Implemented
GetRepositoryPolicy	Implemented
GetSigningConfiguration	Implemented
InitiateLayerUpload	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — started a layer upload.
ListImageReferrers	Implemented
ListImages	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — listed the example repository's images.
ListPullTimeUpdateExclusions	Implemented
ListTagsForResource	Implemented
PutAccountSetting	Implemented
PutImage	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — stored an image manifest. No image was run from it.
PutImageScanningConfiguration	Implemented
PutImageTagMutability	Implemented
PutLifecyclePolicy	Implemented
PutRegistryPolicy	Implemented
PutRegistryScanningConfiguration	Implemented
PutReplicationConfiguration	Implemented
PutSigningConfiguration	Implemented
RegisterPullTimeUpdateExclusion	Implemented
SetRepositoryPolicy	Implemented
StartImageScan	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — the scan was `COMPLETE` at once. No vulnerability scanner was validated.
StartLifecyclePolicyPreview	Implemented
TagResource	Implemented
UntagResource	Implemented
UpdateImageStorageClass	Implemented
UpdatePullThroughCacheRule	Implemented
UpdateRepositoryCreationTemplate	Implemented
UploadLayerPart	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — uploaded a small layer's bytes as one part. Part sizes and corrupted uploads weren't checked.
ValidatePullThroughCacheRule	Implemented