Python flow deployment - How to set private container registry credentials for AWS ECS

[CombatTag]

Hello,

I'm currently working on setting up an AWS ECS push work pool. My runs are failing because I'm publishing my own docker images to a private Github Container Registry and I have not provided my credentials anywhere in my python deployment file or otherwise.

Flow run could not be submitted to infrastructure: TaskFailedToStart - CannotPullContainerError: pull image manifest has been retried 1 time(s): failed to resolve ref ghcr.io/my-org/my-image:latest: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Amy-org%2Fmy-image%3Apull&service=ghcr.io: 401 Unauthorized

It seems ultimately I need to define repositoryCredentials somewhere in my deployment so that the ECS task-definition contains my repository credentials. AWS Task Definition Docs

{
    "taskDefinitionArn": ...
    "containerDefinitions": [
        {
            "name": ...
            "image": ...
            "repositoryCredentials": {
                "credentialsParameter": "AWS_SECRETMANAGER_ARN"
            },
            ...
}

My deploy_flow.py

from prefect.docker.docker_image import DockerImage

@flow(log_prints=True)
def hello():
  print("Hello!")

if __name__ == "__main__":
    hello.deploy(
        name="my-deployment",
        work_pool_name="my-workpool",
        build=False,
        push=False,
        image=DockerImage(
            name="ghcr.io/my-org/my-flows:latest",
            platform="linux/amd64",
        ),
    )

I dug through the docs, other issues and the discussions without any luck. Any help is appreciated!

[CombatTag]

For anyone wondering how to achieve this you can do it by editing your worker pool base job template.