Any pointers on having support publishing docker images to two different aws ecr's and having the authentication work properly. Ideally, I would like the BUILD to dictate where to publish (to dev and prod, or just dev).

Does two separate pants.toml +

PANTS_CONFIG_FILES=this.one ./pants publish ...

work? I.E. The recommended general CI trick?

I didn't want to have to trigger the publishes separately, while also then having to run a filter to determine the registry set on each

So, did you read this?: https://www.pantsbuild.org/docs/tagging-docker-images#configuring-registries

Yes, so we have two registries in our toml file, one named prod and one named dev. Then, we reference those in the docker image.

Is the issue you can't do something like

docker_image(..., registries = ["@dev", "@prod"], ...)

directly because publishing to dev needs a separate login to publishing to prod?

Yes, Huon that is the issue I am trying to solve for.

Do you know if there's

docker

/ AWS commands that allow this outside of pants? (as in, is this a pants issue or is it deeper?)

It looks like there is some hacks to get it to work. That was why I was wondering if anyone had any success with that.

Not knowing anything about this, this example seems to imply Docker knows about mapping certain registries to certain auth providers: https://www.pantsbuild.org/docs/docker#docker-authentication