Expanding container security and choice with Amazon ECR Public

Amazon Elastic Container Registry Public continues to evolve as a trusted platform for container image discovery and distribution. Our platform provides developers and organizations with a robust, secure, and flexible container registry experience built on AWS infrastructure with seamless integration across AWS container services.

At AWS, we understand that container security and flexibility are paramount for modern cloud-native applications. Amazon ECR Public has been strategically developed to support a diverse ecosystem of container images, enabling customers to find, , and deploy trusted images with confidence.

Today, we’re excited to announce that Amazon ECR Public now offers the free tier of Chainguard’s trusted container images —security-hardened, minimalist container images that dramatically reduce vulnerabilities in your containerized applications. By combining Chainguard’s security-first approach with ECR Public’s reliability and AWS integration, developers can now access container images that typically maintain zero or near-zero Common Vulnerabilities and Exposures (CVEs), a significant improvement over traditional base and app images that often contain hundreds of vulnerabilities.

Base images form a critical piece to the foundation of any containerized application. They provide the fundamental operating system components, runtime environments, and core libraries that serve as the starting point for application development. Choosing the right base image is more than a technical decision, it’s a security and performance strategy that impacts the entire application lifecycle. Alongside the most popular base images, the free tier of Chainguard Containers also includes popular third party app images, offering drop-in replacements for the latest versions of images like MongoDB and Postgres.

Through our ongoing partnerships and platform capabilities, we’re committed to delivering a registry that meets the most demanding security and compliance requirements across AWS container services. Our latest expansion showcases how we’re broadening the choices available to customers while maintaining the highest standards of image integrity and security.

Where you source your images critically impacts security, reliability, and operational efficiency. Amazon ECR Public offers several advantages:

Reliability and Performance

AWS infrastructure powers Amazon ECR Public, and Amazon ECR Public delivers high availability and fast image pulls globally. You can depend on consistent performance without worrying registry downtime or throttling.

Seamless AWS Integration

Images from Amazon ECR Public integrate seamlessly with AWS container services including Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), and AWS App Runner. No additional configuration is required—simply reference the image URI in your deployment specifications. For enhanced high availability and resiliency, you can set up Amazon ECR pull-through cache to automatically sync images from ECR Public into your private ECR registry, and then configure replication from your private registry to automatically copy images across multiple AWS Regions. This approach brings images closer to your deployment environments, reduces latency, and provides a resilient, multi-region image distribution strategy.

No charges for pulling public images from Amazon ECR Public. This removes bandwidth costs and usage fees, making it an economical choice for development teams and organizations looking to optimize their container infrastructure expenses.

Amazon ECR Public features verified publishers, including AWS and trusted partners like Chainguard, ensuring you’re pulling images from authentic, reliable sources.

Now available in Amazon ECR Public, Chainguard Containers are security-hardened container images. By sourcing Chainguard Containers directly from Amazon ECR Public, AWS customers can leverage these security-focused images with the reliability and integration benefits of ECR Public. Here are the key advantages:

Minimal Attack Surface

Chainguard Containers include only the essential components needed to run your application. By eliminating unnecessary packages, libraries, and utilities, these images dramatically reduce potential security vulnerabilities, and a smaller image means fewer components to patch, scan, and secure.

Significantly Fewer CVEs

Traditional images often contain hundreds of CVEs. Chainguard container images typically have zero or near-zero CVEs in their base layers. Chainguard achieves this through aggressive minimalism and daily rebuilds of system packages from source, accounting for updates in the source code through broad automation. For security-conscious organizations, this reduction in CVEs translates directly to reduced risk and faster security reviews.

Unlike traditional Linux distributions adapted for containers, Chainguard designed Chainguard OS from the ground up for containerized workloads. This purpose-built approach delivers smaller image sizes, faster startup times, and better resource utilization.

Daily Rebuilds from Source

Chainguard maintains its container images with the Chainguard Factory, automating the rebuild of container images whenever source code is updated, accounting for the latest patches to ensure you’re always provided zero-CVE container images.

Discovering Chainguard Containers in Amazon ECR Public is straightforward:

You can pull the Chainguard container image directly using the standard Docker command: docker pull public.ecr.aws/chainguard/wolfi-base:latest

Let’s walk through a practical example of using Chainguard Containers from Amazon ECR Public to build and deploy a containerized application with your private Amazon ECR repository.

For this implementation guide, you must have the following prerequisites:

Required IAM Permissions

Following the principle of least privilege, create a custom IAM policy with only the permissions needed for this workflow. For creating private repositories and pushing images, your IAM user or role needs the following minimum permission:

Alternately, for convenience, you can use AWS managed policies such as AmazonEC2ContainerRegistryPowerUser (recommended for developers) or AmazonEC2ContainerRegistryFullAccess (provides full administrative access). However, custom policies following least privilege are recommended for production environments.

For detailed IAM policy examples, including complete JSON policy documents, see the Amazon ECR User Guide .

First, create a private repository in Amazon ECR to store your application image:

This command creates a repository with automatic vulnerability scanning enabled. Note the repositoryUri in the response—you’ll need it for pushing your image.

Create a Dockerfile that uses a Chainguard container image from Amazon ECR Public as the base. Since Chainguard images are minimal, we’ll use a multi-stage build with the dev variant for installing dependencies:

For this example, create a simple app.py :

And a requirements.txt :

Now, authenticate to Amazon ECR, build your image, and push it to your repository:

Replace with your actual AWS account ID.

After pushing, Amazon ECR automatically scans your image for vulnerabilities. The scan may take a few minutes to complete. You can view the scan results in the Amazon ECR console:

With Chainguard Containers as your base, you can expect dramatically fewer vulnerabilities compared to traditional base images – a stark contrast to traditional base images that often contain dozens or hundreds of CVEs.

To avoid incurring future charges, delete the resources by running the following commands:

One of the most compelling reasons to use Chainguard Containers is the dramatic reduction in vulnerabilities. Traditional base images often contain dozens or even hundreds of CVEs, many of which exist in packages your application never uses.

Chainguard Containers typically maintain zero or near-zero CVEs by:

This reduction in CVEs means:

The availability of Chainguard Containers in Amazon ECR Public represents a significant advancement in container security for AWS customers. By combining Chainguard’s security-first approach with Amazon ECR Public’s reliability and AWS integration, developers can build more secure containerized applications with less operational overhead.

The dramatic reduction in CVEs, minimal attack surface, and comprehensive supply chain security features make Chainguard Containers an excellent choice for organizations prioritizing security without sacrificing developer productivity. These secure base images integrate seamlessly with AWS container services including Amazon ECS, Amazon EKS, and AWS App Runner.

Start exploring Chainguard Containers in Amazon ECR Public today and take the first step toward more secure container deployments.

*By using Chainguard Containers from Amazon ECR Public, you’re not just pulling a base image—you’re adopting a security-first approach to container development that reduces risk, simplifies compliance, and accelerates your path to production.*

Sourav Kundu is a DevOps Consultant at AWS. He helps organizations securely migrate to and efficiently build on the AWS cloud using modern software engineering practices. He believes that democratizing cloud knowledge is essential for driving innovation and is committed to helping others succeed in their cloud journey.

Gaurav Gundal is a DevOps consultant with AWS Professional Services, helping customers build solutions on the customer platform. When not building, designing, or developing solutions, Gaurav spends time with his family, plays guitar, and enjoys traveling to different places.

Meg Sarros is a Senior Product Manager for Amazon ECR. She is based in New York City. In her spare time, she enjoys tennis and baking.