ECS, ECR & Fargate - Docker in AWS Flashcards
How is Docker different from a Virtual Machine?
Resources are shared with the host -> many containers on one server
How does the EC2 Launch type work?
You must provision & maintain the infrastructure - the EC2 instances
- Each EC2 instance must run the ECS agent to register in the ECS cluster
- AWS starts/stops docker containers on the provisioned instances.
How does ECS Fargate Launch type differ from EC2 Launch type?
You do not provision the infrastructure - no EC2 instances to manage.
- Serverless launch type
What is the EC2 Instance Profile used by and for?
EC2 Launch Type only:
- Used by the ECS agent
- Makes API calls to the ECS service
- Send container logs to CloudWatch logs
- Pull Docker image from ECR
- Reference sensitive data in Secrets Manager or SSM Parameter Store
What is the ECS Task Role?
- Allows each task to have a specific role (e.g., one task might fetch from S3, another from DynamoDB
If you were to integrate ECS with a load balancer, which would be recommended out of ALB, NLB and Elastic Load Balancer and why?
ALB - works for most use cases
NLB - recommended only for high throughput / performance use cases, or to pair it with AWS Private Link
ELB - no advanced features, no Fargate
What does EFS stand for?
Elastic File System
What is a use case for EFS, and why not S3?
Persistent multi-AZ shared storage for your containers - mount the EFS onto ECS tasks (works for both launch types), and any AZ will share the same data in the file system
- S3 cannot be mounted as a file system
What options can you scale on for ECS Application Auto Scaling?
- ECS service average CPU utilization
- ECS service average memory utilization (RAM)
- ALB Request count per target (metric from the ALB)
What is Target Tracking?
Scale based on a target value for a Cloudwatch metric
What is Step Scaling?
Scale based on a specific Cloudwatch alarm
What is Scheduled Scaling?
Scale based on a specified data/time (predictable changes)
What is the difference between ECS Service Auto Scaling and EC2 Auto Scaling?
ECS Service Auto Scaling - Fargate scales the number of taskst
EC2 Auto Scaling - EC2 scales the number of instances
Describe two ways of Auto Scaling EC2 Instances
Auto Scaling Group Scaling:
- Scale your ASG based on CPU Utilization
- Add EC2 instances over time
ECS Cluster Capacity Provider
- Automatically provision and scale the infrastructure for you ECS tasks
- Capacity Provide is paired with an ASG
- Add EC2 instances when you’re missing capacity (CPU, RAM)
What is ECS Rolling Update?
Update from V1 to V2
Set min and max percentage of healthy tasks
- ECS will scale to provide new V2 tasks
- Terminate some V1 tasks, ECS will again scale to provide new V2 tasks
- Repeat until all tasks at V2
What are Task Definitions?
Metadata in JSON form to tell ECS how to run a docker container.
What information is listed in a Task Definition?
- Image name
- Port Binding for Container and Host
- Memory and CPU required
- Environment variables
- Networking information
- IAM role
- Logging configuration (e.g., Cloudwatch)
Describe how you would set up ECS for Dynamic Host Port Mapping
- EC2 Launch Type, ALB as Load Balancer
- Within the Task Definition, only define the container port (not the host port)
- Allow on the EC2 instance Security Group ANY PORT from the ALB’s Security Group
- ALB will find the right port on the EC2 instances
How does Fargate manage Load balancing?
- Each task has a unique private IP
- Only define the container port (not host port)
- Fargate will expose that port on the private IP of each ECS task.
- ECS ENI (Elastic Network Interface) Security group needs to allow the defined port from the ALB
- ALB Security Group needs to allow 80/443 from the web.
How do IAM Roles work with Task Definitions?
- One IAM Role per Task Definition
- Role is defined at the Task Definition level, not at the Service level.
How could you provide a public URL to a Task Definition?
Hardcode the URL as an Environment Variable
How could you provide sensitive data to a Task Definition?
SSM Parameter Store - sensitive variables (e.g., API keys, shared configs)
Secrets Manager - sensitive variables (e.g., DB passwords)
How could you load many environment variables from a file to a Task Definition?
Load environment variables from an S3 bucket - bulk environment variables loading
What is a Bind Mount?
A Data Volume mounted within the ECS task, allowing multiple containers in the same task definition to share data
