Cannot pull images from AWS ECR (login does not seem to work properly)

I'm currently using docker-py 3.7.0 on an Ubuntu VM running Docker version 17.09.0-ce.

I'm having difficulty in what appears to be properly logging into docker. I've tried to get the AWS ECR credentials one of two ways: via boto3 and calling a subprocess for aws ecr get-login.

What happens is that when I try and pull an image, I get the dreaded

repository does not exist or may require 'docker login'

message.

I invoke this script with sudo (eg. sudo ./myscript.py). If, prior to running the script, I run

aws ecr get-login --no-include-email --region us-west2

and then run the results with sudo, the script will properly run.

I've tried variations and even used reauth during login. When I do that, I get the response

http://localhost:None "POST /v1.35/auth HTTP/1.1" 200 48
login_results {'IdentityToken': '', 'Status': 'Login Succeeded'}

I've even deleted the ~/.docker/config.json file but this doesn't help (a new file isn't even written).

here is a code snippet of what I'm doing for the login. It's a little messy right now since I've been trying permutations

    command = "aws ecr get-login --no-include-email --region us-west-2"
    p = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    (out, err) = p.communicate()
    outstr = out.decode("utf-8")
    errstr = err.decode("utf-8")
    if p.returncode == 0:
        # Remove prefix
        outstr = outstr.lstrip('docker login ')
        parts = outstr.split(' ')
        print(parts)
        # -u
        username = parts[1].strip()
        # -p
        password = parts[3].strip()

        registry_url = parts[len(parts)-1].strip()
    else:
        print(p.returncode)
    '''
    token = ecr_client.get_authorization_token()
    username, password = base64.b64decode(token['authorizationData'][0]['authorizationToken']).decode('utf-8').split(":")
    registry_url = token['authorizationData'][0]['proxyEndpoint']
    '''
    print('username {}'.format(username))
    print('password {}'.format(password))
    print('registry_url {}'.format(registry_url))
    docker_client = docker.from_env()
    treg = registry_url + '/'
    login_results = docker_client.login(username=username, password=password, reauth=True, registry=treg)
    print('login_results {}'.format(login_results))

Start with the docker_client.login and docker.from_env entry points shown in the report, then compare the AWS ECR credentials and sudo environment used for the pull. Check the surrounding authentication behavior and reproduce the reported login and pull sequence; done means ECR login persists correctly and the image pull succeeds.