Pull your first image

Private (per-customer) images

Your PodArmor images live in your AWS account's ECR (e.g. customer-specific runtime and build images). Pulling requires AWS credentials that can read the repository:

# Authenticate
aws ecr get-login-password --region <your-region> --profile <your-profile> | \
  docker login --username AWS --password-stdin \
  <account-id>.dkr.ecr.<your-region>.amazonaws.com

# Pull
docker pull <account-id>.dkr.ecr.<your-region>.amazonaws.com/podarmor/<image>:<tag>

The portal's image detail page shows the exact pull command pre-formatted for one-click copy.

Cross-account access

If your AWS account is different from the one PodArmor publishes into, we'll configure a cross-account repository policy on the relevant repos that grants BatchGetImage + GetDownloadUrlForLayer + BatchCheckLayerAvailability to your account's principals.

Once that's in place, your normal AWS profile works without a credential swap. See the Webhooks & integrations section for the policy JSON we apply.