AWS Public ECR biocontainers registry has been deleted?

[alexiswl]

Hello,

It appears that the entire biocontainers registry that we rely on in the ECR Public Gallery has been deleted??

See - https://gallery.ecr.aws/biocontainers/?page=1

Was there an announcement for this?

[mboudet]

So, I just got a warning last week that amazon was killing the docker mirror. (I'm not in any mailing loop regarding this, so maybe the warning was delayed, but I suspect it was fairly sudden).

I don't have an alternative right now, outside of directly using quay / dockerhub directly.

[delagoya]

You can set up a ECR pull-through cache from Quay or Docker Hub using these instructions: https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html

Practically speaking, if this is a production workload you should be copying and scanning images to protect against supply chain attacks.

[alexiswl]

These workflows were run through Illumina Connected Analytics, so I don't think the pull-through-cache would make much sense here, nor do any stderr logs from docker pull commands get propagated to us.

Practically speaking, if this is a production workload you should be copying and scanning images to protect against supply chain attacks.

Sure, and certainly something for us to be thinking of now since AWS has dropped this with no announcements!
How is AWS going to address the potentially very large security vulnerability that they've allowed to be opened up here?

[delagoya]

Good point about ICA. I’ll ask them if there is a way to address this within their system.