A company recently decided to switch their Docker images repository from Docker Hub to Amazon ECR. They also want to use VPC endpoints to secure and privatize the access. What kind of VPC endpoint should they create?