Containers: ECS, Fargate and EKS

In part nineteen we separated the services from each other. Each service still needs somewhere to run, and on an EC2 server that means an image, updates, libraries and the famous sentence: "it works on my machine".

Containers solve this: you package the application with everything it needs in one unit, and it runs the same way on your laptop and in production.

What's a container? #

A container is an isolated process with its own files and libraries, which shares the host's operating system instead of carrying its own.

Image, container and registry #

Three words you'll keep hearing:

• Image: a read-only package of the application and its libraries, like a recipe.
• Container: a running copy of an image. One image can run as a thousand containers.
• Registry: where images are stored, such as Docker Hub or Amazon ECR.

The most common tool for building images is Docker. You write what the image contains in a Dockerfile:

FROM nginx:alpine
COPY index.html /usr/share/nginx/html/

Then you build it, try it on your machine, and push it to a registry:

docker build -t shop .
docker run -p 8080:80 shop
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/shop

Amazon ECR: your images' home #

ECR (Elastic Container Registry) is AWS's image registry, with storage on S3 behind the scenes:

• Private repositories: access to them goes through IAM, so a server or task needs permission to pull.
• Public repositories: anyone can pull from them, through the ECR Public Gallery.
• Extras: image scanning for vulnerabilities, versions with tags, and lifecycle rules that delete old images.

Amazon ECS: AWS's way of running containers #

ECS (Elastic Container Service) takes your images and runs them, keeps them running, and places them behind a load balancer. It's AWS's own service, simpler than Kubernetes, and the service itself has no extra charge. You pay for the capacity it runs on.

Four terms cover the whole service:

Who runs the containers? #

Containers need computing capacity, and you have three options:

With Fargate you state the CPU and memory for a task, and pay for those while it runs. Fargate Spot cuts the price sharply for tasks that can tolerate interruption, in the same way as Spot servers.

Two IAM roles, and confusing them is a classic #

Every Fargate task can have two roles, and they do different jobs:

If the task fails at startup with a pull error, look at the execution role. If your code gets AccessDenied while it's running, look at the task role. And give each service its own task role, not one shared role.

Network and load balancing #

On Fargate each task gets its own network interface and private IP, so it has its own security group like a server. Put an Application Load Balancer in front of the service, and it registers new tasks automatically and removes failed ones. It suits most web applications, and you'd choose a Network Load Balancer for very high throughput or fixed IP addresses.

Storage #

A container's disk disappears with it. To share files between tasks, mount EFS, which works on both Fargate and EC2. And for anything that matters, store it outside the container in S3 or a database.

Scaling #

Service Auto Scaling changes the number of tasks based on average CPU or memory, requests per task from the load balancer, or a schedule. The policies are the same ones we saw in part seven.

On Fargate that's all you need. With EC2 there's a second layer, because you need servers for the new tasks to land on. A capacity provider links the service to an Auto Scaling group and adds servers when tasks need them.

Not just web services #

Tasks don't have to stay running. Three common patterns:

ECS Express Mode: the short way #

Just want a web application from an image, without setting up every piece? ECS Express Mode takes an image and two roles, and creates the Fargate service, load balancer, health checks, scaling and a link. All of it stays in your account, so you can customize it later.

Amazon EKS: Kubernetes #

Kubernetes is an open-source system for running containers, widely used across clouds and data centers. EKS (Elastic Kubernetes Service) runs its control plane for you, across several Availability Zones, at $0.10 per hour per cluster for versions under standard support, on top of the capacity. A version that's past that period costs $0.60 per hour.

Terms differ from ECS: a task is a Pod, and a server is a Node.

For storage, EKS uses CSI drivers to mount EBS, EFS or FSx.

ECS or EKS? #

If nothing is pushing you toward Kubernetes, start with ECS on Fargate.

Containers on your own servers #

Need the same tools outside AWS, such as in your data center?

Hands-on: a service replaces a stopped task #

We'll run a public Nginx image on Fargate, with no build needed. From CloudShell, create the cluster and write the recipe. An image from a public registry with no logs doesn't need an execution role:

aws ecs create-cluster --cluster-name series-cluster \
  --query cluster.status

cat > task.json <<'EOF'
{
  "family": "web",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "256",
  "memory": "512",
  "containerDefinitions": [{
    "name": "web",
    "image": "public.ecr.aws/nginx/nginx:latest",
    "portMappings": [{"containerPort": 80}],
    "essential": true
  }]
}
EOF

aws ecs register-task-definition --cli-input-json file://task.json \
  --query taskDefinition.family

Prepare the network: the default VPC, a subnet, and a security group that allows port 80 from your CloudShell only:

VPC=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true \
  --query "Vpcs[0].VpcId" --output text)
SUBNET=$(aws ec2 describe-subnets --filters Name=vpc-id,Values=$VPC \
  --query "Subnets[0].SubnetId" --output text)

SG=$(aws ec2 create-security-group --group-name series-web \
  --description "Series web task" --vpc-id $VPC \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id $SG \
  --protocol tcp --port 80 \
  --cidr $(curl -s https://checkip.amazonaws.com)/32

NET="awsvpcConfiguration={subnets=[$SUBNET],securityGroups=[$SG],assignPublicIp=ENABLED}"

Run a single task. If this is your first use of ECS and you get an error about the service-linked role, wait a little and repeat the command:

TASK=$(aws ecs run-task --cluster series-cluster --task-definition web \
  --launch-type FARGATE --network-configuration "$NET" \
  --query "tasks[0].taskArn" --output text)

aws ecs wait tasks-running --cluster series-cluster --tasks $TASK

Get its address and try it:

ENI=$(aws ecs describe-tasks --cluster series-cluster --tasks $TASK \
  --query "tasks[0].attachments[0].details[?name=='networkInterfaceId'].value" \
  --output text)
IP=$(aws ec2 describe-network-interfaces --network-interface-ids $ENI \
  --query "NetworkInterfaces[0].Association.PublicIp" --output text)

curl -s http://$IP | grep -i "<title>"

You'll see <title>Welcome to nginx!</title>. Your first container is running, with no server you can see. Now stop it, and it stays stopped, because nothing is looking after it:

aws ecs stop-task --cluster series-cluster --task $TASK \
  --query task.lastStatus

Create a service that keeps one task running:

aws ecs create-service --cluster series-cluster --service-name web \
  --task-definition web --desired-count 1 --launch-type FARGATE \
  --network-configuration "$NET" --query service.status

aws ecs wait services-stable --cluster series-cluster --services web

FIRST=$(aws ecs list-tasks --cluster series-cluster --service-name web \
  --query "taskArns[0]" --output text)
echo $FIRST

aws ecs stop-task --cluster series-cluster --task $FIRST \
  --query task.lastStatus

Wait a minute, then list the tasks:

aws ecs list-tasks --cluster series-cluster --service-name web \
  --query taskArns

The ID has changed. The service noticed the task was gone and started another without you lifting a finger.

aws ecs delete-service --cluster series-cluster --service web --force \
  --query service.status
aws ecs wait services-inactive --cluster series-cluster --services web
aws ecs delete-cluster --cluster series-cluster --query cluster.status
aws ecs deregister-task-definition --task-definition web:1 \
  --query taskDefinition.status
aws ec2 delete-security-group --group-id $SG

Summary #

• A container packages the application and its libraries, and shares the host's system, so it's light and fast.
• ECR stores images, and ECS runs them through a task definition, tasks and a service.
• Fargate spares you from managing servers, and it's the best starting point.
• The execution role belongs to ECS, and the task role belongs to your code.
• EKS is for those who need Kubernetes, and ECS Express Mode is the short way for a web application.

Test yourself #

Before you move on, try these questions to check you've got this part. Each one is a practical scenario, and the explanation appears once you answer.

Containers still run and cost money while waiting. What if your code only ran when there was something to do, and you paid nothing otherwise? In part twenty-one we build an API with Lambda, API Gateway and DynamoDB.