Pulling after logging in to ecr registry appears not to work

Apologies if this is just an oversight on my part, but it stumped me today.

Assuming I have gotten the ecr credentials from boto already in an object called creds, when I do:

client = from_env()
client.login(creds.username, password=creds.password, registry=creds.endpoint)

I get:

{u'IdentityToken': u'', u'Status': u'Login Succeeded'}

Great so far! And I inspect:

client.api.__dict__

I get:

{'_auth_configs': {'auths': {'registry_i_just_logged_into': {'email': None,
'password': 'xxxxxxxxxxxxx',
'serveraddress': 'registry_i_just_logged_into',
'username': 'xxxxxxx'},
u'some_other_registry': {},
'credsStore': u'osxkeychain'}
.... (etc, etc)

Still so far, so good. But when I then do:

client.images.pull("registry_i_just_logged_into/some_repo", tag="latest")

Or when I do (from a command line, and not expecting this to work):

docker pull registry_i_just_logged_into/some_repo:latest

I always get:

Error response from daemon: pull access denied for some_repo, repository does not exist or may require 'docker login'

Despite the fact that, if I do (with the same username and password I used to log in):

client.images.pull("registry_i_just_logged_into/some_repo", tag="latest", auth_config={'username': creds.username, 'password': creds.password})

It works no problems.

I'm dumb. What am I doing wrong?

Thanks!

Start by reproducing the reported sequence: log in with credentials from boto, then pull the ECR image without passing auth_config. Compare that result with the successful pull that supplies auth_config explicitly; done means the login-only flow authenticates the subsequent pull, or the issue documents why it cannot.