What is Amazon ECR, and how does it relate to EKS and Docker?
AWS · Intermediate level
Answer
ECR is AWS's managed container registry for Docker/OCI images. CI builds images, pushes them to ECR, and EKS or ECS pulls them for deployment, ideally using immutable tags, scanning, lifecycle policies, and IAM-controlled access.
Technical explanation
Immutable tags and digest pinning reduce supply-chain ambiguity and deployment drift.
EKS is managed Kubernetes, not no-ops Kubernetes: IAM, networking, add-ons, node strategy, upgrades, RBAC, policies, and workload reliability remain customer responsibilities.
Workload identity, private networking, image security, ingress standards, autoscaling, and observability are foundational controls for production clusters.
Troubleshooting EKS requires separating control-plane, node, CNI, scheduler, ingress, and application failure domains.
Hands-on example
1. Create or use an EKS sandbox cluster with private subnets, managed add-ons, workload IAM, and a sample namespace.
2. Deploy a small container from ECR using Kubernetes manifests or Helm, with readiness/liveness probes and resource requests.
3. Add ingress/load balancing, pod IAM, logging, metrics, and network/security controls relevant to the question.
4. Test node replacement, pod rescheduling, image pulls, access control, and rollback.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More AWS interview questions
- What is the AWS shared responsibility model, and where is the line between AWS and the customer?
- Explain the difference between a Region, an Availability Zone, and an Edge Location.
- What is a VPC, and what are its core components (subnets, route tables, IGW, NAT)?
- Difference between a public and a private subnet, and how does each reach the internet?
- What is the difference between a Security Group and a Network ACL?
- Are Security Groups stateful or stateless? What about NACLs?
- What is an Internet Gateway versus a NAT Gateway, and when do you need each?
- How does a NAT Gateway differ from a NAT instance?