Cache Amazon ECR Public images with StableBuild
StableBuild’s Docker mirror now supports Amazon ECR Public (public.ecr.aws).
Images pulled through the mirror are stored and made immutable. Once an ECR Public tag has been cached, later builds get the same image from StableBuild even if the upstream tag changes or disappears.
ECR Public images can disappear
In May 2026, AWS announced that Bitnami’s 317 container image repositories would be removed from ECR Public after June 10. AWS said pulls from public.ecr.aws/bitnami/ would fail after the removal.
AWS recommended mirroring images that were still needed and using pull-through caching as protection against future upstream changes.
The source code or build configuration referring to an image can remain unchanged long after the image itself has disappeared from the registry.
Using ECR Public through StableBuild
If your Dockerfile currently pulls an image directly from ECR Public:
prepend your StableBuild Docker mirror domain:
The first pull retrieves the image from ECR Public and stores it in StableBuild. Later pulls of that tag return the stored copy.
The cached tag is immutable. If the publisher later changes what the upstream tag points to, StableBuild continues serving the image originally captured.
ECR Public also rate-limits pulls. AWS currently allows one unauthenticated image pull per second, with a default authenticated quota of ten per second. Once an image is cached, later pulls from StableBuild do not require another upstream ECR Public pull.
Support currently covers Amazon ECR Public. Private ECR registries are not supported as of now. If you need private ECR registry support, you can contact us at support@stablebuild.com and we’ll be glad to help!
Rebuilding after the upstream image is gone
Once an image has been cached, rebuilding no longer depends on ECR Public or the publisher continuing to serve that image.
The image does need to reach StableBuild first. If it disappears upstream before it has been pulled through the mirror, StableBuild cannot recover it afterwards.
If a build depends on an ECR Public image, the time to cache it is while the upstream copy is still available.
StableBuild’s Community tier is free, so you can try it with an ECR Public image your build already depends on. See the Docker mirror documentation for setup.
