Containers on ECS and EKS
7 pages · ~5 min✓ Reviewed
Builds on Lambda and Serverless. Next up: Monitoring with CloudWatch and CloudTrail.
ECR and ECS Mental Model
1. ECR Registry
- ECR is a private registry, one per region
- URI:
<account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>
text
123456789012.dkr.ecr.us-east-1.amazonaws.com/web:3f9c2ab
2. ECS Hierarchy
- Clusterholds services
- Servicekeeps N tasks
- Taskrunning instance
- Task definitionthe blueprint
- Task definition: versioned, immutable JSON, named
family:revision - Any change creates a new revision
- Containers in a task share one network namespace and lifecycle
| Choice | When |
|---|---|
| One task | Tightly coupled containers |
| Separate tasks | Everything else |
3. Mistake: :latest
- Revision stores only the tag
:latestmoves to the new image- ECS resolves the tag at task start
- Old revision pulls the new broken image: no rollback
Fix
Tag by git SHA and enable tag immutability.
Task Definitions and Services
1. Task Definition
| Field | Holds |
|---|---|
family | name; each change is a new revision |
cpu, memory | set at task level |
networkMode | awsvpc for Fargate |
containerDefinitions | the containers |
taskRoleArn | app's AWS API calls |
executionRoleArn | pull image, secrets, logs |
image,portMappings,environmentsecretscome from SSM or Secrets ManagerlogConfigurationsends logs to CloudWatch- essential container exits: the whole task stops
2. Service and Scaling
desiredCount= tasks the service keeps running- Rolling update:
minimumHealthyPercentandmaxPercent - Circuit breaker stops a failing deploy and rolls back
--task-definition fam:revpoints the service at a revision
Fargate vs EC2 and IAM Roles
1. Fargate or EC2
- Fargate is serverless: pay per vCPU and GB per second
- No instances to patch
- EC2 launch type: you manage the container instance fleet
- Capacity comes from your ASG capacity provider
| Fargate | EC2 | |
|---|---|---|
| Best for | Most web services, batch work | GPUs, daemon tasks |
| Scale | Any size, no hosts | Very large steady workloads |
| Cost | Per second | Cheaper Spot or Reserved |
2. Execution role vs task role
| Execution role | Task role | |
|---|---|---|
| Used by | ECS itself | Your app code |
| Does | Pulls ECR image, fetches secrets, writes CloudWatch logs | Calls S3, DynamoDB, other AWS APIs |
EKS Basics and When to Choose It
1. What EKS Is
- Managed Kubernetes: AWS runs the control plane (API server, etcd)
- You run workers: managed node groups, self-managed nodes or Fargate profiles
- Pods call AWS APIs via IRSA or EKS Pod Identity
- That is the EKS equivalent of an ECS task role
2. Core Objects
| Object | Job |
|---|---|
| Pod | Smallest unit |
| Deployment | Replicas and rollouts |
| Service | Stable virtual IP |
| Ingress | HTTP routing, backed by the AWS Load Balancer Controller |
3. ECS or EKS?
| ECS | EKS | |
|---|---|---|
| Pick when | AWS-only, least ops | Portability, Helm and operators, team skills |
Discovery, Load Balancers, Logs and Commands
1. Discovery and Load Balancer
- Service Connect or Cloud Map gives tasks a private DNS name:
svc.namespace - Services call each other with no load balancer
- ALB target group: type ip for
awsvpc, the service registers task IPs - healthCheckGracePeriodSeconds delays health-check kills; a bad path kills tasks
- Internet80 / 443
- ALB groupopen to internet
- Task groupcontainer port, source = ALB group
2. Logs
awslogsdriver inlogConfigurationsends stdout and stderr to CloudWatch- Options:
awslogs-group,awslogs-region,awslogs-stream-prefix - The log group must already exist
- Execution role needs
logs:CreateLogStreamandlogs:PutLogEvents
3. Everyday Commands
bash
aws ecr get-login-password | docker login $ECR docker push $ECR/app:$SHA aws ecs register-task-definition --cli-input-json file://td.json aws ecs update-service --task-definition fam:rev --force-new-deployment aws ecs execute-command --task ID --interactive --command sh aws logs tail /ecs/app --follow
update-service points the service at a revision
AWS Containers Cheat Sheet
1. Deploy Flow
- Build image
- Push to ECR
- New revisionregister
- Update service
- ALB health checkpasses
- Traffic shifts
bash
docker push $ACCT.dkr.ecr.$REGION.amazonaws.com/app:$SHA aws ecs register-task-definition --cli-input-json file://td.json aws ecs update-service --cluster c --service s --task-definition app:7
update-service points the service at the revision
Revision stores only the tag
ECS pulls whatever :latest points to at task start. --force-new-deployment alone restarts; it does not roll out a new revision.
2. Roles and Launch Types
| Use it for | |
|---|---|
| Execution role | pull image, secrets, logs |
| Task role | app AWS API calls |
| Fargate | no servers, awsvpc, per-second billing |
| EC2 | GPUs, Spot, full host control |
3. Debug Checklist
| Symptom | Check |
|---|
Check yourself
Every revision uses :latest. A bad image is pushed, you roll back to the previous revision, and it is still broken. Why?
- Answer:
:latestnow points to the broken image, so the old revision pulls it too. - Fix: tag by git SHA, so each revision points to a distinct image.
A Fargate task never starts. What do you check?
- Answer: network path to ECR (private subnet needs NAT or VPC endpoints).
- Execution role needs ECR pull permission.
- The
awslogs-grouplog group must exist.
The app gets S3 AccessDenied, though the execution role allows S3. What is the bug?
- Answer: app code uses the task role, not the execution role.
- Grant S3 on the task role, least privilege.