Role of image tags in production

​

Why tags matter

• latest (or a human-friendly semantic version): convenient for quick testing and ad-hoc deployments, but mutable — each push retags latest.
• Immutable identifier (short commit hash, full digest, or CI build number): provides traceability and safe rollbacks because it points to a specific build artifact.

​

Typical CI flow

1. Log into ECR.
2. Derive an image tag from the commit hash (fallback to latest).
3. Build the image and tag it as both latest and the commit-hash tag.
4. Push both tags to ECR and register the ECS task definition.

version: 0.2
phases:
  pre_build:
    commands:
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin 666234783044.dkr.ecr.eu-central-1.amazonaws.com
      - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
      - IMAGE_TAG=${COMMIT_HASH:-latest}

  build:
    commands:
      - echo "Build started on $(date)..."
      - echo "Building the Docker image..."
      - docker build -t $REPOSITORY_URI:latest .
      - docker tag $REPOSITORY_URI:latest $REPOSITORY_URI:$IMAGE_TAG

  post_build:
    commands:
      - echo "Build completed on $(date)..."
      - echo "Pushing the Docker image..."
      - docker push $REPOSITORY_URI:latest
      - docker push $REPOSITORY_URI:$IMAGE_TAG
      - aws ecs register-task-definition --cli-input-json file://task-definition.json

• COMMIT_HASH extracts a short commit ID from the CodeBuild environment variable CODEBUILD_RESOLVED_SOURCE_VERSION.
• IMAGE_TAG becomes the short commit hash when available; otherwise, it falls back to latest.
• Two tags are pushed so you can reference images by latest for quick tests and by commit-hash for production rollbacks and audits.

​

Benefits of tagging with commit hashes

• Traceability: Identify the exact source commit that produced a deployed image.
• Rollbacks: To revert, update the ECS task definition to reference the REPOSITORY_URI:EB7245DB tag (or whichever commit tag you want) and redeploy. This ensures ECS pulls the image built from that commit.
• Auditing: Correlate images in ECR with repository history and CI runs to support compliance and incident investigations.

​

Quick reference: tag types

​

Example rollback instructions

1. Edit the task definition to reference the exact image tag, e.g. 123456789012.dkr.ecr.us-east-1.amazonaws.com/myrepo:EB7245DB.
2. Register the new task definition revision:
   • aws ecs register-task-definition --cli-input-json file://task-definition.json
3. Update the service to use the new task definition revision:
   • aws ecs update-service --cluster my-cluster --service my-service --task-definition my-task:3

​

Links and references

• AWS Elastic Container Registry (ECR): https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html
• Docker image tag best practices: https://docs.docker.com/engine/reference/commandline/tag/
• AWS CodeBuild buildspec reference: https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html
• AWS ECS task definitions: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html