Per the documentation on accessing the Manager remotely you can do this locally:
ssh -i aws-host-key-file -NL localhost:2374:/var/run/docker.sock docker@<docker-manager-public-ip> &
Then i used my local aws install:
aws ecr get-login --region us-east-1
And modified there response to include the -H localhost:2374, like so:
docker -H localhost:2374 login -u AWS -p <token> -e none https://<registry-url>
Then you can create a stack like so that works with ECS included in the yaml:
docker -H localhost:2374 stack deploy --compose-file stack.yml --with-registry-auth <service-name>
This allowed me to create new stacks or services with ECR. What I don’t know is if scheduling will continue to work after the token has expired.