Do tags even work this way in an ECR repository?

Doesn't a tag only ever refer to exactly 1 image?

Also, I think repos are by default created with tag immutability, because that's what security wants.

I think the difference here is:

• In S3, tags are nonfunctional metadata
• In ECR (Docker), tags are a functional part of how you address the image

(They're not the same type of tag)

You can AWS-tag the repository itself... but it has limits key <128 chars, value <256 chars.

Don't know about the max amount of tags.

You could put the following tags on the repo:

aws-cdk:isolated:dde07f18495b1339c13905d5442a78c5 = 1729615771053
aws-cdk:isolated:3bbc165593b6e2a4dcd6e7d72ac51fac = 1729615783885

And never do more than X tags like this. We'll eventually clean out the repo, it just might take a while

Doesn't a tag only ever refer to exactly 1 image?

you can have multiple tags per image.

the id of an image is its digest, which is different than its tag apparently.

Also, I think repos are by default created with tag immutability, because that's what security wants.

tag immutability shouldn't apply here - we are not overwriting any existing tags.

you could argue that it looks weird to tag our isolated images this way (because you can in theory pull from the isolated tag if you really wanted to) -- but i think this is at least doable. unless we really can't do this, i prefer tagging images this way as opposed to using the repo-level tags

Here's an example of what it looks like in the console:

Doesn't a tag only ever refer to exactly 1 image?

you can have multiple tags per image.

That's not what I said though. Can you have 2 images with the same tag?

If not, how are you going to tag multiple images for garbage collection? Are you guaranteeing that the timestamps are all unique?

I guess conceivably it might be doable if you use JavaScript timestamps with millisecond resolution and increment them for each; we'd need to tag more than 1000 images/second for that to become inaccurate enough to care about it (and even then... meh).

Even given this... I'm not sure I'm comfortable putting this metadata in a load-bearing location. I guess we can try it and see if it breaks things, or puts undue load on ECR.

(A bit of a design overview in a doc comment of the class would have been extremely helpful reasoning through these concerns)

We've decided offline to go with the Docker tags method as repository tags are limited in number (~50 metadata tags per resource). The issue with Docker tags is ensuring that each tag is unique, and we will do that via timestamps + increments.

this was wrong and was not used anywhere

Thank you!

Please turn these fields around, so that they more or less lexicographically sort correctly.

Also -- you have logic around building and splitting this string. Would be nice if that logic lived together. So the building logic should live next to the splitting logic, most likely on ImageAsset then.