Write ShopLite and Push It to ECR

1. 1

   Write the ShopLite API

   No dependencies, just Node's built-in http module. Two things matter for infrastructure: /healthz is what the load balancer checks, and the port and version come from environment variables that Terraform sets. The app handles SIGTERM so ECS can stop it gracefully during deploys.

   import http from "node:http";
   
   const port = Number(process.env.PORT ?? 8080);
   const version = process.env.APP_VERSION ?? "dev";
   
   const products = [
     { id: 1, name: "Masala Chai", price: 120 },
     { id: 2, name: "Filter Coffee", price: 90 },
     { id: 3, name: "Mango Lassi", price: 150 },
   ];
   
   function json(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
   }
   
   const server = http.createServer((req, res) => {
     if (req.url === "/healthz") return json(res, 200, { status: "ok" });
     if (req.url === "/products") return json(res, 200, products);
     return json(res, 200, { service: "shoplite-api", version });
   });
   
   server.listen(port, () => console.log(`shoplite-api ${version} listening on ${port}`));
   
   process.on("SIGTERM", () => {
     console.log("SIGTERM received, draining");
     server.close(() => process.exit(0));
   });

2. 2

   Package it

   "type": "module" enables import syntax. The Dockerfile runs as the unprivileged node user. .dockerignore keeps local junk out of the image.

   # app/package.json:  { "name": "shoplite-api", "version": "1.0.0", "type": "module" }
   # app/.dockerignore: node_modules  .git  *.log
   
   FROM node:22-alpine
   WORKDIR /app
   COPY package.json server.js ./
   USER node
   EXPOSE 8080
   CMD ["node", "server.js"]

3. 3

   Declare the repository

   force_delete is computed from the environment: in dev, terraform destroy may delete a repository with images in it, which is convenient when tearing down between sessions; in prod it may not. The lifecycle policy keeps the newest 20 images so storage doesn't grow forever.

   resource "aws_ecr_repository" "api" {
     name                 = "${var.project}/api"
     image_tag_mutability = "IMMUTABLE"
     force_delete         = var.environment != "prod"
   
     image_scanning_configuration {
       scan_on_push = true
     }
   }
   
   resource "aws_ecr_lifecycle_policy" "api" {
     repository = aws_ecr_repository.api.name
   
     policy = jsonencode({
       rules = [{
         rulePriority = 1
         description  = "Keep the newest 20 images"
         selection = {
           tagStatus   = "any"
           countType   = "imageCountMoreThan"
           countNumber = 20
         }
         action = { type = "expire" }
       }]
     })
   }

4. 4

   Output the repository URL and apply

   output "ecr_repository_url" {
     value = aws_ecr_repository.api.repository_url
   }

   terminalcopy cmd

   $ cd infra && terraform apply

   ── expected output ──

   Plan: 2 to add, 0 to change, 0 to destroy.

   ...

   Outputs:

   ...

   ecr_repository_url = "123456789012.dkr.ecr.ap-south-1.amazonaws.com/shoplite/api"

5. 5

   Build for ARM and push

   ShopLite runs on Graviton (ARM) Fargate, which is cheaper per unit of compute. On an Intel/AMD machine, --platform linux/arm64 makes buildx cross-build; on Apple Silicon it's native. The registry host is the part of the URL before the first /.

   terminalcopy cmd

   $ REPO=$(terraform output -raw ecr_repository_url)

   aws ecr get-login-password | docker login --username AWS --password-stdin "${REPO%%/*}"

   docker buildx build --platform linux/arm64 -t "$REPO:1.0.0" --push ../app

   ── expected output ──

   Login Succeeded

   [+] Building 14.2s (8/8) FINISHED

   => [1/3] FROM docker.io/library/node:22-alpine

   => [2/3] WORKDIR /app

   => [3/3] COPY package.json server.js ./

   => exporting to image

   => pushing 123456789012.dkr.ecr.ap-south-1.amazonaws.com/shoplite/api:1.0.0

6. 6

   Confirm the image and its scan

   Scan-on-push runs automatically. Check for findings before the image goes anywhere near production; Stage 7 makes this a pipeline gate.

   terminalcopy cmd

   $ aws ecr describe-images --repository-name shoplite/api \

   --query 'imageDetails[].[imageTags[0],imageSizeInBytes,imageScanStatus.status]' --output table

   ── expected output ──

   ------------------------------------------

   | DescribeImages |

   +--------+------------+------------------+

   | 1.0.0 | 47811234 | COMPLETE |

   +--------+------------+------------------+

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.