Container Delivery: Build, Tag, Push, Promote

In this module, you'll learn to:

• Build an image once, and promote that same image through every environment
• Use immutable tags and digests, so you always know what's running
• Log in to a registry in a way that works in headless CI

Before you start: you'll want Docker, the AWS CLI v2, an ECR repository, and a CI/CD system that can assume an AWS role.

Build once, then promote the same image

Building an image is the easy part. What matters in operation is being able to say exactly which image is running in which environment, and moving that same image forward instead of rebuilding it for each environment. Rebuilding from the same commit usually gives you the same thing, but "usually" isn't a guarantee: a base image or dependency can change in between.

How the original deployment tagged images

The deployment this track is based on put the environment and a build number in the tag, for example qa1.0.42, then retagged the image for production (prod1.0.10). It was readable at a glance and it kept the rule that the image isn't rebuilt. But the tag says nothing about what's inside the image, and a tag can be moved to point at a different image later.

# Build and push once, tagged with the commit
docker build -t <registry>/my-service:sha-3f9c2e1 .
docker push <registry>/my-service:sha-3f9c2e1

# Make tags permanent for this repository (one-time setup)
aws ecr put-image-tag-mutability --repository-name my-service \
  --image-tag-mutability IMMUTABLE

# Look up the image's digest
aws ecr describe-images --repository-name my-service \
  --image-ids imageTag=sha-3f9c2e1 --query 'imageDetails[0].imageDigest'

# Promotion means changing this one line in each environment, never rebuilding
containers:
  - name: my-service
    image: <registry>/my-service@sha256:<digest>

Promoting to Production is then a small, reviewable change that points Production at the digest QA already tested. You can still add a friendly tag such as prod-2026-09-28 for people to read, but the digest is what guarantees the match.

Registry login breaks in headless CI/CD

docker login normally asks for a password at the terminal. That's invisible when you try the command by hand, because it just works. Then the same step runs in a CI/CD job, where there's no terminal to type into, and it fails with:

Error: Cannot perform an interactive login from a non-TTY device

Fix

# Prompts for a password, so it fails in a headless CI/CD job:
docker login --username AWS <registry>

# Headless-safe: pipe a short-lived token in through stdin
aws ecr get-login-password --region <region> \
  | docker login --username AWS --password-stdin <registry>

The fix passes a temporary token through standard input instead of a prompt, which is exactly what a job with no terminal needs. (Older scripts may use aws ecr get-login, which only existed in AWS CLI v1 and was removed in v2; replace it with the command above.) This kind of bug is worth calling out because it never shows up in local testing. It only appears once the pipeline runs for real, which is usually later than you'd like.

Key terms

• Promotion: moving the same tested image to the next environment, without rebuilding it.
• Digest: an image's content hash (sha256:...); the same digest is always the same bytes.
• Immutable tags: a registry setting that stops a tag from being overwritten.
• Headless: running without a terminal, as CI jobs do.

Pop quiz

Five questions: three on the ideas in this module, and two scenarios where you apply them. The order changes every time you take it, and 4 out of 5 passes.