diff --git a/knowledge base/cloud computing/aws/ecs.md b/knowledge base/cloud computing/aws/ecs.md index c452826..7d247dd 100644 --- a/knowledge base/cloud computing/aws/ecs.md +++ b/knowledge base/cloud computing/aws/ecs.md @@ -18,6 +18,7 @@ 1. [EFS volumes](#efs-volumes) 1. [Docker volumes](#docker-volumes) 1. [Bind mounts](#bind-mounts) +1. [Networking](#networking) 1. [Execute commands in tasks' containers](#execute-commands-in-tasks-containers) 1. [Scale the number of tasks automatically](#scale-the-number-of-tasks-automatically) 1. [Target tracking](#target-tracking) @@ -167,6 +168,9 @@ Whatever the [launch type] or [capacity provider][capacity providers]: 1. ECS starts the task's containers. 1. ECS moves the task into the `RUNNING` state. +> [!important] +> Task definition's parameters differ depending on the launch type. + ## Standalone tasks Refer [Amazon ECS standalone tasks]. @@ -520,11 +524,11 @@ The 100ms period allows for vCPUs ranging from 0.125 to 10. Task-level CPU and memory parameters are ignored for Windows containers. -The `cpu` value must be expressed in _CPU units_ or _vCPUs_.
-_vCPUs_ are converted to _CPU units_ when task definitions are registered. +The `cpu` value must be expressed in _CPU units_ or _vCPUs_. A CPU unit is 1/1024 of a full vCPU.
+_vCPUs_ values are converted to _CPU units_ when task definitions are registered. The `memory` value can be expressed in _MiB_ or _GB_.
-_GB_s are converted to _MiB_ when tasks definitions are registered. +_GB_ values are converted to _MiB_ when tasks definitions are registered. These fields are optional for tasks hosted on EC2.
Such tasks support CPU values between 0.25 and 10 vCPUs. these fields are optional @@ -547,11 +551,52 @@ Fargate task definitions support **only** those [specific values for tasks' CPU The _task's_ settings are **separate** from the CPU and memory values that can be defined at the _container definition_ level. +Reservations configure the **minimum** amount of resources that containers or tasks receive.
+Using more than the reservation's amount is known as _bursting_.
+ECS _guarantees_ reservations. It doesn't place a task on an instance that cannot fulfill the task's reservation. + +Limits are the **maximum** amount of resources that containers or tasks can use.
+Attempts to use more CPU more than the limit results in throttling. Attempt to use more memory then the limit results in +the container being stopped for OOM reasons. + Should both a container-level `memory` and `memoryReservation` value be set, the `memory` value **must be higher** than the `memoryReservation` value.
If specifying `memoryReservation`, that value is guaranteed to the container and subtracted from the available memory resources for the container instance that the container is placed on. Otherwise, the value of `memory` is used. +Swap usage is controlled at container-level.
+Swap space must be enabled and allocated on the EC2 instance hosting the task, for the containers to use it. By default, +ECS optimized AMIs do **not** have swap enabled. Also, Fargate does **not** support it. + +`maxSwap` determines the total amount of swap memory in MiB a container can use.
+It must be `0`, or any positive integer number. Setting it to `0` disables swapping.
+If omitted, the container uses the swap configuration for the container instance it is running on. + +`swappiness` tunes a container's memory swappiness behavior.
+It **requires** the `maxSwap` value to be set. If a value isn't specified for `maxSwap`, `swappiness` is ignored.
+It accepts whole numbers between 0 and 100. `0` causes swapping to **not occur unless required**. `100` causes pages to +be swapped aggressively.
+If omitted, it defaults to `60`. + +
+ +```json +{ + "containerDefinitions": [ + { + "linuxParameters": { + "maxSwap": 512, + "swappiness": 10 + }, + … + } + ], + … +} +``` + +
+ ## Environment variables Refer [Amazon ECS environment variables]. @@ -702,6 +747,42 @@ Tasks running on Fargate receive a minimum of 20 GiB of ephemeral storage for bi This can be increased up to a maximum of 200 GiB by specifying the `ephemeralStorage` parameter in the task's definition. +## Networking + +The networking behavior of tasks that are hosted on EC2 instances is dependent on the network mode that one defined in +the task's definition. + +In `awsvpc` network mode, each task is allocated its own Elastic Network Interface (ENI) and a primary private IPv4 +address. This gives the task the same networking properties as EC2 instances.
+AWS recommends using the `awsvpc` network mode, unless one has the specific need to use a different network mode. + +In `host` network mode, the networking of the container is tied directly to the underlying host executing it.
+Only supported for tasks hosted on EC2 instances, not supported when using Fargate. + +With `bridge` mode, a virtual network bridge creates a layer between the host and the container's networking.
+It allows to create port mappings to remap host ports to container ports. Mappings can be static or dynamic.
+Only supported for tasks hosted on EC2 instances, not supported when using Fargate. + +Tasks on Fargate are each provided an ENI with a primary **private** IP address, which allows them to use networking +features such as VPC Flow Logs or PrivateLink.
+When using a public subnet, one can _optionally_ assign a public IP address to the task's ENI.
+If the VPC is configured for dual-stack mode, and tasks are using a subnet with an IPv6 CIDR block, the tasks' ENI +**also** receive an IPv6 address. + +Fargate fully manages the ENIs it creates.
+One cannot manually detach nor modify those ENIs. To release the ENIs for a task, stop the task. + +A task can only have **one** ENI associated with it at a time. + +Containers belonging to the same task **can** communicate over the `localhost` interface. + +Tasks on Fargate that need to pull a container image must have a route to the container registry. + +An ECS service-linked role is **required** to provide ECS with the permissions to make calls to other AWS services on +one's behalf.
+Such role is automatically created when creating a cluster, or when creating or updating a service in the AWS Management +Console. + ## Execute commands in tasks' containers Refer [Using Amazon ECS Exec to access your containers on AWS Fargate and Amazon EC2],