code: func (authProvider *ecrAuthProvider) GetAuthconfig(image string,
  	registryAuthData *apicontainer.RegistryAuthenticationData) (types.AuthConfig, error) {
  
  	if registryAuthData == nil {
  		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's registry auth data")
  	}
  
  	authData := registryAuthData.ECRAuthData
  
  	if authData == nil {
  		return types.AuthConfig{}, fmt.Errorf("dockerauth: missing container's ecr auth data")
  	}
  
  	// First try to get the token from cache, if the token does not exist,
  	// then call ECR api to get the new token
  	key := cacheKey{
  		region:           authData.Region,
  		endpointOverride: authData.EndpointOverride,
  		registryID:       authData.RegistryID,
  	}
  
  	// If the container is using execution role credentials to pull,
  	// add the roleARN as part of the cache key so that docker auth for
  	// containers pull with the same role can be cached
  	if authData.GetPullCredentials() != (credentials.IAMRoleCredentials{}) {
  		key.roleARN = authData.GetPullCredentials().RoleArn
  	}
  
  	// Try to get the auth config from cache
  	auth := authProvider.getAuthConfigFromCache(key)
  	if auth != nil {
  		return *auth, nil
  	}
  
  	// Get the auth config from ECR
  	return authProvider.getAuthConfigFromECR(image, key, authData)
  }
docs: // GetAuthconfig retrieves the correct auth configuration for the given repository