Build a Docker image, push it to Amazon ECR, and pull it onto a Lightsail instance — plus the IAM-user vs. role wrinkle that trips people up.