# Container Builds

## Authentication

For AWS CodeBuild, you can use project or user access tokens for authenticating your build with Depot. We recommend using project tokens as they are scoped to the specific project and are owned by the organization.

### [Project token](/content/docs/cli/authentication#project-tokens/index.html)

You can inject project access tokens into the CodeBuild environment for `depot` CLI authentication. Project tokens are tied to a specific project in your organization and not a user.

### [User access token](/content/docs/cli/authentication#user-access-tokens/index.html)

You can inject a user access token into the CodeBuild environment for `depot` CLI authentication. User tokens are tied to a specific user and not a project. Therefore, it can be used to build all projects across all organizations which the user has access.

## Configuration

To build a Docker image from AWS CodeBuild, you must set the `DEPOT_TOKEN` environment variable by [injecting it from Secrets Manager](https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#secrets-manager-build-spec). Note that you also need to grant your IAM service role for CodeBuild permission to access the secret.

```
{
  "Version": "2012-10-17",
  "Statement": [ \
    { \
      "Sid": "Statement1", \
      "Effect": "Allow", \
      "Action": "secretsmanager:GetSecretValue", \
      "Resource": "<arn-of-your-project-token-in-secrets-manager>" \
    } \
  ]
}
```

### CodeBuild EC2 compute type

With a project or user token stored in Secrets Manager, you can add the `DEPOT_TOKEN` environment variable to your `buildspec.yml` file, install the `depot` CLI, and run `depot build` to build your Docker image. The following example shows the configuration steps when using the EC2 compute type.

```

```

### CodeBuild Lambda compute type

The CodeBuild Lambda compute type requires installing the `depot` CLI in a different directory that is in the `$PATH` by default. The following example shows the configuration steps when using the Lambda compute type.

```

```

**Note:** The CodeBuild Lambda compute type does not support privileged mode. Therefore, you cannot use the `--load` flag to load the image back into the Docker daemon as there is no Docker daemon running in the Lambda environment.

## Examples

### Build multi-platform images natively without emulation

This example shows how you can use the `--platform` flag to build a multi-platform image for Intel and Arm architectures natively without emulation.

```

```

### Build and push to AWS ECR

This example demonstrates building and pushing a Docker image to AWS ECR from AWS CodeBuild via Depot.

Note that you need to grant your IAM service role for CodeBuild permission to access the ECR repository by adding the following statement to its IAM policy:

```
{
  "Action": [ \
    "ecr:BatchCheckLayerAvailability", \
    "ecr:CompleteLayerUpload", \
    "ecr:GetAuthorizationToken", \
    "ecr:InitiateLayerUpload", \
    "ecr:PutImage", \
    "ecr:UploadLayerPart" \
  ],
  "Resource": "*",
  "Effect": "Allow"
}
```

### Logging into ECR with the EC2 compute type

When using the EC2 compute type in CodeBuild, you can login to your ECR registry with `docker login` via the [documented methods](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html#sample-docker-files) provided by ECR. To access `docker login`, you must make sure that your CodeBuild environment is configured with Privileged mode turned on.

```

```

### Logging into ECR with the Lambda compute type

You can build a Docker image with the Lambda compute type in CodeBuild and push it to ECR without using the `docker login` command by writing the Docker authentication file yourself at `$HOME/.docker/config.json` and use the [`--push`](/content/docs/cli/reference/container-builds#depot-build/index.html) flag. Note that you can't load the image back into the Docker daemon with the Lambda compute type.

```

```

#### Obtaining an authenticated Docker config.json

Alternatively, you can copy a pre-configured, authenticated `config.json` by logging into the Docker registry and copying the `config.json` file.

```
$ docker login -u your-username
Password: <type your password>

$ cat ~/.docker/config.json
```

You can now copy the contents of the `config.json` file and use it in your CodeBuild configuration.

### Build and load the image back for testing

You can download the built container image into the workflow using the [`--load` flag](/content/docs/cli/reference/container-builds#depot-build/index.html).

```

```

### Build, push, and load the image back in one command

You can simultaneously push the built image to a registry and load it back into the CI job using the [`--load` and `--push`](/content/docs/cli/reference/container-builds#depot-build/index.html) flags together.

```

```