AWS EC2 Container Service (ECS) & EC2 Container Registry (ECR) | Docker Registry

bogotobogo.com site search:

Key componets of EC2 Container Service (ECS)

Container instances:
1. EC2 instances
2. Docker daemon
3. ECS agents (open source in Github : aws/amazon-ecs-agent)

Cluster is a logical grouping of container instances that we can place tasks on:
1. Collection of resources - resource pool (primarily containers and insances running those insances)
2. Scalable
3. Grouping of container instances
Task definition is a description of an application that contains one or more container definitions:
1. Container definitions (cpu, memory, links to set up channels between containers, ports)
2. Volume definitions to persist data between containers
3. Task definitions are tracked by names and versions
Task is an instantiation of a task definition that is running on a container instance:
1. Unit of work
2. We can run as many containers as we our app needs
3. Runs on container instances
Service is a scheduler that ensures that the specified number of tasks are constantly running and rescheduled on failure, and optionally registered against an Elastic Load Balancing load balancer:
1. We just refer task definition and number of tasks we want to run
2. ECS handles the deployment and integration with ELB

EC2 Container Registry (ECR)

Here are the benefits of using ECR:

Security:
1. IAM resource based policies
2. Cloud Trail audit logs
3. Images encrypted at transit and at rest
Ease of managing and deploying images:
1. Tight integration with ECSs
2. Integration with Docker toolset
3. AWS Management Console and AWS CLI
Reliability and performance: S3 backed

Setting up EC2 Container Service (ECS)

In this post, we'll deploy a Flask app to AWS ECS.

Configure repository: A repository is a place that we store Docker images in Amazon ECR. Every time we push or pull an image from Amazon ECR, we specify the registry and repository location to tell Docker where to push the image to or where to pull it from.

Build, tag, and push Docker image
If AWS CLI is not installed yet, let's install it. We need AWS CLI because we want to push our Docker image to Repository (ECR). We push the image once we get the login credentials from CLI:

Download the AWS CLI Bundled Installer:

$ curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"

Unzip the package:
```
$ unzip awscli-bundle.zip
```

Run the install executable:

$ sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws

Now that our repository exists, we can push a Docker image by following these steps:

Retrieve the docker login command that we can use to authenticate our Docker client to our registry:

$ aws ecr get-login --region us-east-1
docker login -u AWS -p AQECA...AT2 -e none https://526262051452.dkr.ecr.us-east-1.amazonaws.com

Or we can combine the two previous commands into one command:

$ eval $(aws ecr get-login --region us-east-1)
Login Succeeded

We need to add a file ./app/requirements.txt:

Flask==0.11.1

And the image has the following (main.py):

from flask import Flask
app = Flask(__name__)

@app.route("/")
def hello():
    return "Hello World from Flask in a uWSGI Nginx Docker container with \
     Python 2.7 (default)"

if __name__ == "__main__":
    app.run(host='0.0.0.0', debug=True, port=80)

Build our Docker image using the following command. For information on building a Docker file from scratch see the instructions here. We can skip this step if our image is already built:

$ docker build -t ecs-circleci-einsteinish .
Step 1 : FROM tiangolo/uwsgi-nginx-flask:flask
 ---> 788ca94b2313
Step 2 : COPY ./app /app
 ---> Using cache
 ---> 0666386303c5
Successfully built 0666386303c5

Let's check if our docker image is correctly built, on local machine:
```
$ docker run -t ecs-circleci-einsteinish
```
To get the ip of docker on our hostmachine:
```
$ docker inspect --format '{{ .NetworkSettings.IPAddress }}' $(docker ps -q)
172.17.0.2
```
We can see it works:

After the build completes, tag the image so we can push the image to the newly created repository (ECR):

$ docker tag ecs-circleci-einsteinish:latest 526262051452.dkr.ecr.us-east-1.amazonaws.com/ecs-circleci-einsteinish:latest

Run the following command to push this image to the repository:

$ docker push 526262051452.dkr.ecr.us-east-1.amazonaws.com/ecs-circleci-einsteinish:latest

Create a task definition via JSON
Basically the task definition tells how we want to run the container. The JSON file looks like this:

{
    "containerDefinitions": [
        {
            "name": "flask-app-container",
            "image": "526262051452.dkr.ecr.us-east-1.amazonaws.com/ecs-circleci-einsteinish:latest",
            "memory": "128",
            "cpu": "10",
            "essential": true,
            "portMappings": [
                {
                    "hostPort": "80",
                    "containerPort": "80",
                    "protocol": "tcp"
                }
            ],
            "environment": null,
            "mountPoints": null,
            "volumesFrom": null,
            "hostname": null,
            "user": null,
            "workingDirectory": null,
            "extraHosts": null,
            "logConfiguration": null,
            "ulimits": null,
            "dockerLabels": null
        }
    ],
    "volumes": [],
    "networkMode": "bridge",
    "placementConstraints": [],
    "family": "flask-app-task"
}

Task definitions specify various parameters for our application, such as which containers to use and the repositories in which they are located, which ports should be opened on the container instance for our application, and what data volumes should be used with the containers in the task.

We have registered our ECS Task Definition!

Let's create the ECS cluster. Select Clusters in the left-hand navigation pane:

When we run tasks using Amazon ECS, we place them on a cluster, which is a logical grouping of EC2 instances. Amazon ECS downloads our container images from a registry that we specify, and runs those images on the container instances within our cluster.

Create a service

The service describes how we want our task definitions to run.

Amazon ECS allows us to run and maintain a specified number (the "desired count") of instances of a task definition simultaneously in an ECS cluster. This is called a service. If any of our tasks should fail or stop for any reason, the Amazon ECS service scheduler launches another instance of our task definition to replace it and maintain the desired count of tasks in the service.