Hands-on emulator lab · 6–10 min
Keep container releases in a trusted registry — ECR and Container images
Create an image repository and enable its basic scan-on-push setting.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Create an image repository and enable its basic scan-on-push setting.
Why this matters
A container repository has release-management and scanning settings before images arrive. You will create an immutable-tag repository and enable scan on push. No image upload or vulnerability scan is claimed.
Words you will use
An image packages a container app. A registry stores images. A tag is a name attached to an image. A digest identifies the image content.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create a private repository
Create an ECR repository record for practice container images. A repository holds image versions. This exercise does not upload an image or expose a public registry.
2. Enable scanning on push
Save scanOnPush as true. This configures basic scanning behavior for new images. A setting alone does not prove that an image was scanned or that it contains no vulnerabilities.
3. Read the repository configuration
Describe the repository and inspect its immutable-tag and scan-on-push settings. This lab verifies repository configuration, not an actual image scan.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.