As organizations move toward multi-cloud or decide to shift workloads between cloud providers, migrating container images becomes a critical task. One common requirement is transferring images from AWS Elastic Container Registry (ECR) to Oracle Cloud Infrastructure Registry (OCIR).
In this article, i used Skopeo a powerful image management tool to migrate entire repositories, including all tags, from ECR to OCIR. This guide also includes a practical script that uses Docker login + Skopeo for secure image transfer.
What is Skopeo?
Skopeo is an open-source CLI tool that performs operations on container registries without needing Docker or Podman running in the background.
Why Skopeo?
No local image pull needed – copies images directly from registry to registry
Fast layer transfers – only missing layers are pushed
Daemonless – reduces overhead, avoids Docker dependency
Supports all major registries – AWS ECR, OCIR, GCR, DockerHub, Quay, GitHub Container Registry, etc.
Secure authentication – works with AWS IAM token and OCIR auth token
Because of these advantages, Skopeo is the best tool for migrating images across cloud providers.
Migrating ECR to OCIR Using Skopeo
Below is the method I used:
✔ Authenticate to AWS ECR using Docker
✔ Authenticate to OCIR using Docker
✔ Get all tags from the ECR repository
✔ Loop through each tag
✔ Copy from ECR → OCIR using Skopeo
This is a recommended and production-ready approach.
1. Authenticate to AWS ECR
AWS ECR uses temporary auth tokens. We log in using Docker:
aws ecr get-login-password --region $AWS_REGION | \
docker login --username AWS --password-stdin $ECR_DOMAIN
2. Authenticate to OCIR
OCIR requires an auth token, not your console password.
docker login $OCI_REGISTRY \
--username "${OCI_NAMESPACE}/oracleidentitycloudservice/${OCIR_EMAIL}" \
--password "${OCIR_TOKEN}"
Where:
$OCI_REGISTRY → ap-sydney-1.ocir.io
$OCI_NAMESPACE → Your tenancy namespace
$OCIR_EMAIL → Your login email
$OCIR_TOKEN → OCIR auth token
TAGS=$(aws ecr list-images \
--region $AWS_REGION \
--repository-name $ECR_REPO \
--query 'imageIds[*].imageTag' \
--output text)
This captures all tags so every version of your image is copied.
Below is your exact logic, written in clean article format:
for TAG in $TAGS; do
if [ "$TAG" == "None" ]; then
echo "Skipping untagged image in $ECR_REPO"
continue
fi
SRC="docker://${ECR_DOMAIN}/${ECR_REPO}:${TAG}"
DEST="docker://${OCI_REGISTRY}/${OCI_NAMESPACE}/${OCI_REPO}:${TAG}"
echo "Copying $SRC → $DEST"
skopeo copy --all \
--src-creds "AWS:$(aws ecr get-login-password --region $AWS_REGION)" \
--dest-creds "$OCIR_CREDS" \
"$SRC" "$DEST"
done
What happens here?
--src-creds authenticates to AWS ECR using fresh token
--dest-creds authenticates to OCIR
The --all flag ensures all image manifests and multi-arch data are copied
Skopeo moves layers directly registry → registry without local storage
Why This Approach Is Effective
| Benefit | Explanation |
| Secure | No plaintext passwords; AWS token auto-rotates |
| Fast | Direct registry-to-registry transfer |
| Automated | Loop copies all image tags |
| No local pull/push | Saves disk space; ideal for CI/CD |
| Multi-arch compatible | Works with ARM + AMD images |
This method is commonly used in cloud migrations, DR planning, and multi-cloud container strategies.
Conclusion
Migrating container images from AWS ECR to OCI Container Registry (OCIR) is simple and efficient when using Skopeo. Its ability to copy images directly between registries combined with Docker authenticationmakes it perfect for large migrations where reliability, speed, and automation are essential.
