Amazon ECR Public
- Free allowance
- 50 GB per month of always-free storage for public repositories: 'Both new and existing customers get 50 GB per month of always-free storage for their public repositories.' Past 50 GB it is not blocked — storage is billed to the repository owner: pricing table 'All storage / month ... per GB'...
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- institution?placeholder, not evidence; card unknown, phone unknown
- Binding limit
- noneno named constraint binds
- Evidence
- reported4 sources; a third party said so
- Freshness
- stale on 2026-11-05checked 2026-10-21 (inherited); stale on 2026-11-05
| Free tier | 50 GB per month of always-free storage for public repositories: 'Both new and existing customers get 50 GB per month of always-free storage for their public repositories.' Past 50 GB it is not blocked — storage is billed to the repository owner: pricing table 'All storage / month ... per GB' resolves via AWS's price API to $0.1000000000/GB-month. unit GB; metered on stored-bytes |
|---|---|
| Price | none stated |
| Identity | institution (inferred, not read) not published |
| Egress | Half-free, and the free half is generous: 'You can anonymously (without using an AWS account) transfer 500 GB of data to the Internet from a public repository each month for free. If you sign up for an AWS account, or authenticate to Amazon ECR with an existing AWS account, you can transfer 5 TB of data to the Internet from a public repository each month for free.' Past that: 'Greater than 5 TB / month to non AWS Regions | $0.09 per GB'. Anonymous overage is not billed, it is refused: 'Up to 500 GB/month can be transferred out to non-AWS destinations to clients that have not authenticated (that is, anonymously). After that limit is reached, no further anonymous data transfer is allowed.' Zero egress cost to AWS compute in any region. free allowance: 5 TB per month |
| Per-object cap | not stated |
| Retention | not stated |
| Interface | oci, cli oci |
| Tooling | docker/skopeo/oras/crane; ORAS pushes arbitrary blobs as OCI artifacts. AWS CLI for auth (aws ecr-public get-login-password). |
| Composes with | 50 GB x N AWS accounts. Egress is per-downloader-IP for anonymous pulls and 5 TB/month for any authenticated AWS account, so a single account gives 5 TB/mo of public egress, and each additional free AWS account gives another 5 TB/mo as the authenticated client. Storage is only 50 GB/account, so the economics are inverted versus most registries: egress scales, storage does not. |
| Reliability | Very stable; the 1 pull/s anonymous rate limit is the thing that bites bulk fetches (a parallel fetcher must spread across IPs or authenticate). |
| Parsed numbers |
|
Evidence 4
| date | source | what it proved |
|---|---|---|
| 2026-10-21 | aws.amazon.com/ecr/pricing/ | 50 GB always-free public storage; 500 GB/mo anonymous egress, 5 TB/mo authenticated, $0.09/GB beyond |
| 2026-10-21 | docs.aws.amazon.com/AmazonECR/latest/public/public-service-q | 'unauthenticated image pulls 1 per second', max layer 10,000 MiB |
| 2026-10-21 | b0.p.awsstatic.com/pricing/2.0/meteredUnitMaps/ecr/USD/curre | rateCode zY12MU_... price 0.1000000000 (storage $/GB-mo) |
| 2026-10-21 | public.ecr.aws/v2/ | probe: GET -> 401 with Www-Authenticate: Bearer realm="https://public.ecr.aws/token/"; GET /token/?service=public.ecr.aws&scope=repository:amazonlinux/amazonlinux:pull -> {"token":...}; GET /v2/amazonlinux/amazonlinux/manifests/latest with that Bearer -> 200, Content-Type application/vnd.docker.distribution.manifest.list.v2+json |
Unknown values 4
- per object cap notes: the field may be stated in a source that was not read
- per object cap stated: the field may be stated in a source that was not read
- retention notes: the field may be stated in a source that was not read
- retention stated: the field may be stated in a source that was not read