mrjones-plip · June 22, 2026 19:02
diff --git a/.AWS ECR find and delete images bash scripts.md b/.AWS ECR find and delete images bash scripts.md
diff --git a/.gitignore b/.gitignore
 .idea/
 cache/
 cache_public/
 cache_private/
 *BAK
 *.txt
 *.csv
 *.log

diff --git a/aws_ecr_stats.sh b/aws_ecr_stats.sh
 #!/bin/bash

 check_login() {
  # Check if user is logged in
  if ! aws sts get-caller-identity &> /dev/null; then
    echo "ERROR: Seems like your SSO session is invalid. Please run"
    printf "\n  $ aws sso login\n\n"
    echo "before you run the script."
    exit 1
  fi
 }

 generate_repo_list() {
  pp=$1
  cache_dir=./cache_$pp
  mkdir -p "$cache_dir"

  if [[ "$pp" == "public" ]]; then
    command_start="aws ecr-public  --region  us-east-1"
  else
    command_start="aws ecr"
  fi

  repo_list_cache=$cache_dir/all.repos.json
  if [ ! -f "$repo_list_cache" ]; then
    eval "$command_start describe-repositories --output json > $repo_list_cache"
  fi
 }

 generate_stats() {

  if [[ "$pp" == "public" ]]; then
    command_start="aws ecr-public describe-images  --region us-east-1"
    output_title="PUBLIC_REPOSITORY"
  else
    command_start="aws ecr describe-images"
    output_title="PRIVATE_REPOSITORY"
  fi

  pp=$1
  cache_dir=./cache_$pp
  index=1
  data=$(jq .repositories $repo_list_cache)
  repo_count=$(echo "$data" | jq length)

  for name in $(echo $data | jq -r .[].repositoryName); do
    # Get repo images
    clean_name=$(echo $name|sed "s/\//_/g")
    repo_cache=$cache_dir/$clean_name.json
    if [ ! -f "$repo_cache" ]; then
      echo -en "\033[K"
      echo -n "[$index/$repo_count] CREATING $pp $name" $'\r'
      # shellcheck disable=SC2086
      eval "$command_start --repository-name $name  --output json > $repo_cache"
    fi
    repo_images=$(cat "$repo_cache")

    # Get size
    size=$(echo "$repo_images" | jq .imageDetails[].imageSizeInBytes | awk '{s+=$1}END{OFMT="%.0f";print s}')

    # Get image count
    image_count=$(echo "$repo_images" | jq '.imageDetails | length')

    if [ -n "$size" ]; then
      raw_size="$size"
      size=$(numfmt --to=iec --suffix=B --format "%.2f" "$size")
    else
      raw_size="0"
      size="<no-images>"
    fi

    tag_count=$(grep -c imageTags "$repo_cache")
    tagless_count=$((image_count-tag_count))
    repos="${repos}$name $size $image_count $tag_count/$tagless_count\n"
    sizes="${sizes}$raw_size\n"
    name_lens="${name_lens}${#name}\n"
    image_counts="${image_counts}$image_count\n"

    t_tagged=$(($t_tagged+tag_count))
    total_untagged=$((total_untagged+tagless_count))
    index=$((index + 1))
  done

  # Sort repos by size
  repos=$(printf "$repos" | sort -k2 -h)

  # Add separator before total
  max_name_len=$(printf "$name_lens" | sort -n | tail -1)
  repos="${repos}\n$(printf -- '-%.0s' $(seq ${max_name_len})) -------- -------- --------\n"

  # Add total size and image count
  t_size=$(printf "$sizes" | awk '{s+=$1}END{OFMT="%.0f";print s}')
  t_images=$(printf "$image_counts" | awk '{s+=$1}END{print s}')
  repos="${repos}TOTAL $(numfmt --to=iec --suffix=B --format "%.2f" "$t_size") $t_images $t_tagged/$total_untagged\n"

  # Print final table
  # shellcheck disable=SC2059
  printf "$output_title SIZE IMAGE_COUNT TAGGED/UNTAGGED\n$repos" | awk '
  BEGIN {
      FS=" ";
      OFS="\t";
  }
  {
      if (NR == 1) {
          header1 = $1;
          header2 = $2;
          header3 = $3;
          header4 = $4;
      } else {
          $2 = sprintf("%10s", $2);
          $3 = sprintf("%11s", $3);
          $4 = sprintf("%12s", $4);
      }
      print $0;
  }' | column -t
 }

 main() {
  repos=""
  sizes=""
  name_lens=""
  image_counts=""
  t_tagged=0
  total_untagged=0

  check_login

  options="public private"
  for pp in $options; do
    generate_repo_list "$pp"
    generate_stats "$pp"
    echo
  done
 }

 main
diff --git a/backup.images.sh b/backup.images.sh
 #!/bin/sh

 services="foo/bar-quux foo/bar-api foo/bar-smang"
 versions="4.20.1 4.21.0 4.21.1 4.22.0 5.0.0 5.0.1 5.0.3 5.1.0 5.1.1 5.1.2 5.1.3 "

 for s in $services; do
    echo Archiving images for $s
    for v in $versions; do
        image=public.ecr.aws/$s:$v
        docker pull -q $image
    done
 done
diff --git a/batch.delete.images.sh b/batch.delete.images.sh
 #!/usr/bin/env bash

 # delete images based on SHA256 hash, repository and if it's a public or private repo in ECR
 # 
 # signature is: 
 #
 #     ./batch.delete.images.sh CSV_FILE PUBLIC_OR_PRIVATE
 # 
 # for example: 
 #
 #    ./batch.delete.images.sh jun22.images.to.delete.csv public
 # 
 # Best practice is to capture output to a file for error analysis after the run:
 #
 #    ./batch.delete.images.sh jun22.images.to.delete.csv public > delete.results.log 
 # 
 # expects a CSV with lines in this format:
 #
 #    "DATE","sha256:HASH","repo/path"
 #
 # So for example:
 #
 #    "2018-08-24T10:28:12-07:00","sha256:43348e8cd8b809213565447b773ff1abc7e2919503880d9cad4549f313b88f84","foo-bar/quux-smang"
 #    "2020-08-12T07:10:32-07:00","sha256:a06f9a68ee807827cadb7887cdeac9abd8376f9e2711475ecec8edbbc0a3ddb6","foo-bar/bash-dashboard"
 # 
 # Requires `aws` CLI tool to be installed and logged in to your account 

 set -e

 MAX_IMAGES=99

 delete_images() {
  repo=$1
  id_collection=$2
  pp=$3

  if [[ "$pp" == "public" ]]; then
    command_start="aws ecr-public --region us-east-1"
  else
    command_start="aws ecr"
  fi

  # disable globbing (SC2086) because other wise id_collection gets passed in as one
  #   argument instead of N arguments (and we want N)
  # shellcheck disable=SC2086
  eval "$command_start" batch-delete-image  --repository-name "$repo" --image-ids $id_collection
 }

 read_file() {
  csv_file=$1
  repo=$2
  pp=$3
  count=1
  id_collection=''
  echo "start $repo $csv_file "
  csv_data=$(grep "$repo" "$csv_file")
  while read -r line; do
    line=${line//\"/}
    id=$(echo "$line"|cut -d, -f2)
    repo=$(echo "$line"|cut -d, -f3)

    id_collection="imageDigest=$id $id_collection"

    if [ $count -gt $MAX_IMAGES ];then
      delete_images "$repo" "$id_collection" "$pp"
      count=1
      id_collection=''
    else
      count=$((count + 1))
    fi

  done <<< "$csv_data"
 }

 loop_through_repos(){
  csv_file=$1
  pp=$2
  repos=$(cut -d, -f3 "$csv_file"|sort|uniq)
  while read -r repo; do
    read_file "$csv_file" "$repo" "$pp"
  done <<< "$repos"
 }

 csv_file=$1
 pp=$2
 loop_through_repos "$csv_file" "$pp"
	#!/bin/bash

	check_login() {
	# Check if user is logged in
	if ! aws sts get-caller-identity &> /dev/null; then
	echo "ERROR: Seems like your SSO session is invalid. Please run"
	printf "\n $ aws sso login\n\n"
	echo "before you run the script."
	exit 1
	fi
	}

	generate_repo_list() {
	pp=$1
	cache_dir=./cache_$pp
	mkdir -p "$cache_dir"

	if [[ "$pp" == "public" ]]; then
	command_start="aws ecr-public --region us-east-1"
	else
	command_start="aws ecr"
	fi

	repo_list_cache=$cache_dir/all.repos.json
	if [ ! -f "$repo_list_cache" ]; then
	eval "$command_start describe-repositories --output json > $repo_list_cache"
	fi
	}

	generate_stats() {

	if [[ "$pp" == "public" ]]; then
	command_start="aws ecr-public describe-images --region us-east-1"
	output_title="PUBLIC_REPOSITORY"
	else
	command_start="aws ecr describe-images"
	output_title="PRIVATE_REPOSITORY"
	fi

	pp=$1
	cache_dir=./cache_$pp
	index=1
	data=$(jq .repositories $repo_list_cache)
	repo_count=$(echo "$data" \| jq length)

	for name in $(echo $data \| jq -r .[].repositoryName); do
	# Get repo images
	clean_name=$(echo $name\|sed "s/\//_/g")
	repo_cache=$cache_dir/$clean_name.json
	if [ ! -f "$repo_cache" ]; then
	echo -en "\033[K"
	echo -n "[$index/$repo_count] CREATING $pp $name" $'\r'
	# shellcheck disable=SC2086
	eval "$command_start --repository-name $name --output json > $repo_cache"
	fi
	repo_images=$(cat "$repo_cache")

	# Get size
	size=$(echo "$repo_images" \| jq .imageDetails[].imageSizeInBytes \| awk '{s+=$1}END{OFMT="%.0f";print s}')

	# Get image count
	image_count=$(echo "$repo_images" \| jq '.imageDetails \| length')

	if [ -n "$size" ]; then
	raw_size="$size"
	size=$(numfmt --to=iec --suffix=B --format "%.2f" "$size")
	else
	raw_size="0"
	size="<no-images>"
	fi

	tag_count=$(grep -c imageTags "$repo_cache")
	tagless_count=$((image_count-tag_count))
	repos="${repos}$name $size $image_count $tag_count/$tagless_count\n"
	sizes="${sizes}$raw_size\n"
	name_lens="${name_lens}${#name}\n"
	image_counts="${image_counts}$image_count\n"

	t_tagged=$(($t_tagged+tag_count))
	total_untagged=$((total_untagged+tagless_count))
	index=$((index + 1))
	done

	# Sort repos by size
	repos=$(printf "$repos" \| sort -k2 -h)

	# Add separator before total
	max_name_len=$(printf "$name_lens" \| sort -n \| tail -1)
	repos="${repos}\n$(printf -- '-%.0s' $(seq ${max_name_len})) -------- -------- --------\n"

	# Add total size and image count
	t_size=$(printf "$sizes" \| awk '{s+=$1}END{OFMT="%.0f";print s}')
	t_images=$(printf "$image_counts" \| awk '{s+=$1}END{print s}')
	repos="${repos}TOTAL $(numfmt --to=iec --suffix=B --format "%.2f" "$t_size") $t_images $t_tagged/$total_untagged\n"

	# Print final table
	# shellcheck disable=SC2059
	printf "$output_title SIZE IMAGE_COUNT TAGGED/UNTAGGED\n$repos" \| awk '
	BEGIN {
	FS=" ";
	OFS="\t";
	}
	{
	if (NR == 1) {
	header1 = $1;
	header2 = $2;
	header3 = $3;
	header4 = $4;
	} else {
	$2 = sprintf("%10s", $2);
	$3 = sprintf("%11s", $3);
	$4 = sprintf("%12s", $4);
	}
	print $0;
	}' \| column -t
	}

	main() {
	repos=""
	sizes=""
	name_lens=""
	image_counts=""
	t_tagged=0
	total_untagged=0

	check_login

	options="public private"
	for pp in $options; do
	generate_repo_list "$pp"
	generate_stats "$pp"
	echo
	done
	}

	main
	#!/bin/sh

	services="foo/bar-quux foo/bar-api foo/bar-smang"
	versions="4.20.1 4.21.0 4.21.1 4.22.0 5.0.0 5.0.1 5.0.3 5.1.0 5.1.1 5.1.2 5.1.3 "

	for s in $services; do
	echo Archiving images for $s
	for v in $versions; do
	image=public.ecr.aws/$s:$v
	docker pull -q $image
	done
	done