How to Migrate AWS ECR Images to OCI Container Registry (OCIR) Using Skopeo – Complete Guide

As organizations move toward multi-cloud or decide to shift workloads between cloud providers, migrating container images becomes a critical task. One common requirement is transferring images from AWS Elastic Container Registry (ECR) to Oracle Cloud Infrastructure Registry (OCIR).

In this article, i used Skopeo a powerful image management tool to migrate entire repositories, including all tags, from ECR to OCIR. This guide also includes a practical script that uses Docker login + Skopeo for secure image transfer.

What is Skopeo?

Skopeo is an open-source CLI tool that performs operations on container registries without needing Docker or Podman running in the background.

Why Skopeo?

• No local image pull needed – copies images directly from registry to registry

• Fast layer transfers – only missing layers are pushed

• Daemonless – reduces overhead, avoids Docker dependency

• Supports all major registries – AWS ECR, OCIR, GCR, DockerHub, Quay, GitHub Container Registry, etc.

• Secure authentication – works with AWS IAM token and OCIR auth token

Because of these advantages, Skopeo is the best tool for migrating images across cloud providers.

Migrating ECR to OCIR Using Skopeo

Below is the method I used:
✔ Authenticate to AWS ECR using Docker
✔ Authenticate to OCIR using Docker
✔ Get all tags from the ECR repository
✔ Loop through each tag
✔ Copy from ECR → OCIR using Skopeo

This is a recommended and production-ready approach.

1. Authenticate to AWS ECR

AWS ECR uses temporary auth tokens. We log in using Docker:

aws ecr get-login-password --region $AWS_REGION | \
docker login --username AWS --password-stdin $ECR_DOMAIN

• $AWS_REGION – Example: us-east-1

• $ECR_DOMAIN – Example: 896077038029.dkr.ecr.us-east-1.amazonaws.com

2. Authenticate to OCIR

OCIR requires an auth token, not your console password.

docker login $OCI_REGISTRY \
  --username "${OCI_NAMESPACE}/oracleidentitycloudservice/${OCIR_EMAIL}" \
  --password "${OCIR_TOKEN}"

Where:

• $OCI_REGISTRY → ap-sydney-1.ocir.io

• $OCI_NAMESPACE → Your tenancy namespace

• $OCIR_EMAIL → Your login email

• $OCIR_TOKEN → OCIR auth token

3. Fetch All Image Tags from the ECR Repository

TAGS=$(aws ecr list-images \
    --region $AWS_REGION \
    --repository-name $ECR_REPO \
    --query 'imageIds[*].imageTag' \
    --output text)

This captures all tags so every version of your image is copied.

4. Loop Through Tags and Copy Images Using Skopeo

Below is your exact logic, written in clean article format:

for TAG in $TAGS; do
    if [ "$TAG" == "None" ]; then
        echo "Skipping untagged image in $ECR_REPO"
        continue
    fi

    SRC="docker://${ECR_DOMAIN}/${ECR_REPO}:${TAG}"
    DEST="docker://${OCI_REGISTRY}/${OCI_NAMESPACE}/${OCI_REPO}:${TAG}"

    echo "Copying $SRC → $DEST"

    skopeo copy --all \
      --src-creds "AWS:$(aws ecr get-login-password --region $AWS_REGION)" \
      --dest-creds "$OCIR_CREDS" \
      "$SRC" "$DEST"
done

What happens here?

• --src-creds authenticates to AWS ECR using fresh token

• --dest-creds authenticates to OCIR

• The --all flag ensures all image manifests and multi-arch data are copied

• Skopeo moves layers directly registry → registry without local storage

Why This Approach Is Effective

This method is commonly used in cloud migrations, DR planning, and multi-cloud container strategies.

Conclusion

Migrating container images from AWS ECR to OCI Container Registry (OCIR) is simple and efficient when using Skopeo. Its ability to copy images directly between registries combined with Docker authenticationmakes it perfect for large migrations where reliability, speed, and automation are essential.