minimumReleaseAge support for ECR public gallery - proven workaround

[dc2tom]

Tell us more.

As I'm not able to create a new issue on this project am I able to make a suggestion for allowing minimumReleaseAge timestamps to support the upstream amazon ECR public gallery docker registry?

I've been following #37196 and can see why using the repo author overridable releaseTimestamp is not a suitable suggestion, as a compromised registry could have its releaseTimestamp overwritten. However ECR public does offer up imagePushedAt and also createdAt which look to be equivalent to the metadata Docker Hub provides. These aren't included in the Docker manifest but they are available as separate undocumented API operations.

I've written a script to obtain the required imagePushedAt or createdAt timestamps, there's a nuance as the public gallery doesn't allow non browser API calls, so renovate would have to impersonate a browser by setting certain headers such as:

# Contract captured from gallery.ecr.aws: a REST-style POST to
# /describeImageTags with a plain JSON body (no X-Amz-Target). The endpoint
# sits behind a WAF that rejects non-browser clients, so we must send
# browser-like headers (a real User-Agent + Origin) — a generic User-Agent
# gets HTTP 403.
_ECR_GALLERY_URL = "https://api.us-east-1.gallery.ecr.aws/describeImageTags"
_ECR_GALLERY_HEADERS = {
    "Content-Type": "application/json",
    "Accept": "*/*",
    "Origin": "https://gallery.ecr.aws",
    "Referer": "https://gallery.ecr.aws/",
    "User-Agent": (
        "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
        "(KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
    ),
}

you can then grab a json response like the below:

            {
            "imageTag": "11.0.31-al2-native-jdk",
            "createdAt": "2026-06-13T11:42:42.461Z",
            "imageDetail": {
                "imageDigest": "sha256:d9b34140ff6ee628a1be5adda2f52b26cdcd3d0f2b2bee99345fbc9567051873",
                "imageSizeInBytes": 224649280,
                "imagePushedAt": "2026-06-13T11:42:41.312Z",
                "imageManifestMediaType": "application/vnd.docker.distribution.manifest.list.v2+json"
            }
        },...

As much as this isn't an officially published API could renovate be altered to support it, as only Docker Hub is supported for release timestamps at present, and ECR public is used heavily by a lot of organisations.

[jamietanna]

Would https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeImageTags.html not work? I think we'd want to avoid pretending to be a browser to avoid their scraping protection

[dc2tom]

AWS support came back and confirmed my suspicions:

---

I encountered the same error:

aws: [ERROR]: An error occurred (RepositoryNotFoundException) when calling the DescribeImageTags operation: The repository with name 'aws-cli/aws-cli' does not exist in the registry with id '<My AWS account ID>'.

At the same time, I tried to describe a public repository under my own AWS account and was able to do so successfully. This confirms that the DescribeImageTags API only operates on repositories within the caller's own registry, until specific resource based IAM permission is granted.

I would like to clarify the difference between Amazon Elastic Container Registry Public and the Amazon ECR Public Gallery:

Amazon Elastic Container Registry Public:
Amazon Elastic Container Registry Public is a managed AWS container image registry service that is secure, scalable, and reliable. Your client must authenticate to a public registry as an AWS user before they can push images to a public repository. For image pulls, Amazon ECR Public accepts both anonymous pulls and pulls using an authentication token [1]. A public registry is provided to each AWS account; you can create public image repositories in your public registry and store images in them.

Amazon ECR Public Gallery
The Amazon ECR Public Gallery is a public website for finding and sharing container images hosted in Amazon ECR public repositories. There is no authentication required to browse the public repositories and pull the images [2]. The main purpose of Amazon ECR Public Gallery is to provides search filters that make it easy to browse through the public repositories.

I have shared the AWS documentation [1,2] that explains the difference between the two. In summary, while you are able to pull images from any ECR public repository, you cannot use the DescribeImageTags API to describe images in Amazon ECR Public Gallery.

However, if you would like to retrieve image tag details from the public gallery programmatically, you can use the ECR Public Gallery REST API. Below is a sample command, feel free to modify it for your use case:

curl -s "[https://api.us-east-1.gallery.ecr.aws/describeImageTags](https://api.us-east-1.gallery.ecr.aws/describeImageTags)" \
  -H "Content-Type: application/json" \
  -d '{"registryAliasName":"aws-cli","repositoryName":"aws-cli"}' | python3 -m json.tool

If you have any further concerns, or if I have misunderstood your issue, I would recommend connecting over a Chime session for further clarification and troubleshooting. Please share your availability, and I will do my best to accommodate your schedule. My working hours are Monday to Friday, 10:30 AM to 4:30 PM UTC+1 (Dublin-based).

I hope the above information is helpful regarding this issue. If you have any additional questions or concerns, please let me know, as I am always happy to assist you in the best possible way.

So - we can get away without browser spoofing - we only actually need the Content-Type header, and AWS have stated that they are ok with customers using this API even though it is not documented.

[RahulGautamSingh]

Sounds good to me, thoughts @viceice @jamietanna @secustor

[viceice]

https://api.us-east-1.gallery.ecr.aws/describeImageTags sounds interesting to use for public ecr. We should somehow allow to use another regional api if available, so eg users in europe can use more nearby servers

[viceice]

we can probably simply use the official public ecr api 🤔

• https://docs.aws.amazon.com/general/latest/gr/ecr-public.html

[dc2tom]

Hi @viceice the public gallery does not exist outside of that region, and the AWS API doesn't support the public gallery - take a look at my comments above particularly the AWS enterprise support response.