by Erin McGill, Partner Solutions Architect, AWS By packaging software into standardized units, containers give code everything it needs to run, ensuring consistency from your laptop all the way into production. But once you have your code ready to ship, how do you run and scale it in the cloud? In this session, you will learn about your options for running containers on AWS and the integrated AWS services that you can take advantage of to run and scale containerized applications.

1. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Erin McGill, Partner Solutions Architect
June 21, 2018
Getting Started with Docker on AWS

2. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Why containers? FizzBuzz!

3. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Application environment components
Runtime Engine Code
Dependencies Configuration

4. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Local Laptop Staging / QA Production On-Premises
Different environments

5. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Local Laptop Staging / QA Production On-Prem
It worked on my machine, why not in
prod?
v6.0.0 v7.0.0 v4.0.0 v7.0.0

6. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Containers to the rescue
Runtime Engine
Code
Dependencies

7. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Docker
Lightweight container virtualization platform.
Tools to manage and deploy your applications.
Licensed under the Apache 2.0 license.
First released March 2013
Built by Docker, Inc.

8. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Docker Image
Read only image that is used as a
template to launch a container.
Start from base images that have
your dependencies, add your custom
code.
Docker file for easy, reproducible
builds.
bootfs
kernel
Base image
Image
Image
W
ritable
Container
add
ngix
add
nodejs
U
buntu
References
parent
image

9. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Local Laptop Staging / QA Production On-Prem
Four environments, same container

10. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
VMs versus Containers

11. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Benefits
Portable runtime application environment
Package application and dependencies in a single artifact
Run different application versions (different dependencies)
simultaneously
Faster development & deployment cycles
Better resource utilization

12. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Use Cases
Consistent environment between Development & Production
Service-Oriented Architectures / Micro-services
Short lived workflows
Isolated environments for testing

13. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Using Docker is easy!
docker build
docker tag
docker push
docker run

14. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Server
Guest OS
Bins/Libs Bins/Libs
App2App1
Using Docker is easy!

15. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
A few hosts?
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS

16. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Lots of hosts!

17. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
AWS Container Services Landscape
MANAGEMENT
Deployment, Scheduling,
Scaling & Management
HOSTING
Where the containers run
Amazon EC2
IMAGE REGISTRY
Container Image Repository

18. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.

19. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Amazon Elastic Container Service (Amazon ECS)
• Container management service
• Fully managed
• Scalable and Highly Available
• Microservices, batch workers,
machine learning applications
• Integrated with
• Amazon ECR
• AWS networking, storage,
management tools
• AWS Fargate

20. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Amazon ECS
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

21. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Cluster of hosts
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

22. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Lightweight agent on each host
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

23. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
API for launching containers on the cluster
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet

24. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Container task is placed on a host
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

25. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Traffic is sent to your host
EC2 INSTANCES
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container AGENT COMMUNICATION
SERVICE
Amazon
ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
Internet LOAD
BALANCER
LOAD
BALANCER

26. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
PRODUCTION WORKLOADS ON AWS
AWS VPC
networking mode
Advanced task
placement
Deep integration
with AWS platform
ECS CLI…{ }
Global footprint
Powerful scheduling
engines
Auto scaling
CloudWatch metrics
Load balancers

27. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Amazon Elastic Container Registry (Amazon ECR)
• Cloud-based Docker image registry
• Fully managed
• Secure – images encrypted at rest,
integrated with IAM
• Scalable and Highly Available
• Integrated with Amazon ECS and the
Docker CLI

28. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Customers Using Containers at Scale

29. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
CUSTOMERS ARE OUR KEY!
50+
releases
since 2015
CUSTOMERS
RELEASE
FEEDBACK /
NEW USE
CASES
LEARN
EXPERIMENT,
INNOVATE,
& BUILD
FEATURES

30. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Cluster
Management
is a relic
of physical
infrastructure

31. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
ENABLE FOCUS ON APPLICATIONS

32. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
INTRODUCING FARGATE!

33. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
CHANGING COMPUTE
CONSUMPTION MODEL
No instances
to manage
Task
native API
Resource
based pricing Simple, easy to use,
powerful – and new
consumption model

34. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
PRODUCTION WORKLOADS ON AWS
AWS VPC
networking mode
Advanced task
placement
Deep integration
with AWS platform
ECS CLI…{ }
Global footprint
Powerful scheduling
engines
Auto scaling
CloudWatch metrics
Load balancers

35. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Using Amazon ECS

36. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Deploying Containers on ECS – Choose a
Scheduler
Task scheduler
Batch Jobs
Run tasks once
RunTask (random)
StartTask (placed)
Service scheduler
Long-Running Apps
Health management
Scale-up and scale-down
AZ aware
Placement strategies

37. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Running services

38. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Task Definitions
Volume Definitions
Container Definitions

39. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Key Components: Task Definitions

40. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Key Components: Task Definitions

41. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Tasks
Shared Data Volume
Containers
schedule
Container
Instance
Volume Definitions
Container Definitions

42. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Unit of work
Grouping of related Containers
Runs on Fargate or EC2
Tasks

43. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Create a Service
Good for long-running
applications and services

44. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Create Service
Load Balance traffic across containers
Automatically recover unhealthy containers
Discover services
ElasticLoadBalancing
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers

45. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Scale Service
Scale up
Scale down
ElasticLoadBalancing
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers

46. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service
Deploy new version
Drain connections
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
new new new
ElasticLoadBalancing
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
old old old

47. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service (cont.)
Deploy new version
Drain connections
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
new new new
ElasticLoadBalancing
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
old old old

48. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service (cont.)
Deploy new version
Drain connections
ElasticLoadBalancing
Shared Data Volume
Containers
Shared Data Volume
Containers
Shared Data Volume
Containers
new new new

49. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service (cont.)
Specify a deployment configuration for your service:
• minimumHealthyPercent: lower limit (as a percentage of
the service's desiredCount) of the number of running
tasks that must remain running in a service during a
deployment.
• maximumPercent: upper limit (as a percentage of the
service's desiredCount) of the number of running tasks
that can be running in a service during a deployment.

50. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service (cont.)
Deploy using the least space: minimumHealthyPercent =
50%, maximumPercent = 100%

51. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Update Service (cont.)
Deploy quickly without reducing service capacity:
minimumHealthyPercent = 100%, maximumPercent =
200%

52. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Routing via Application Load Balancer
Path-based routing
Allows you to define rules that route traffic to different target groups based on the path of a URL.
e.g example.com/test , example.com/test/test1
Dynamic Port Mapping
Provides the ability to load-balance across multiple ports on the same Amazon EC2 instance. This functionality specifically
targets the use of containers and is integrated into Amazon ECS.
HTTP/2
WebSockets
Detailed Logging

53. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Routing via Network Load Balancer
IP-based routing
Allows you to define rules that route traffic to different target groups based on the header information in the TCP
connection.
Layer 4 - TCP Pass Through
The NLB allows you to form direct TCP connections from clients to Amazon ECS tasks and services. This allows source
IP data to be passed directly to containers.
Dynamic Port Mapping
Provides the ability to load-balance across multiple ports on the same Amazon EC2 instance. This functionality
specifically targets the use of containers and is integrated into Amazon ECS.
High Throughput
Capable of handling millions of requests per second while maintaining ultra-low latencies.
Optimized to handle sudden and volatile traffic patterns while using a single static or dynamic IP address per
Availability Zone

54. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
TASK NETWORKING - BRIDGE
Io
eth0 172.17.0.1/16
Io
Io
ve-c2
(172.17.0.3/16)
ve-c2
(172.17.0.2/16)
Default/Root Global Namespace
Container 1
Container 2
172.16.0.0
172.16.1.0
172.16.2.0
VPC
10.0.0.26
10.0.0.0/24
docker0
Io
eth0 172.17.0.1/16
Io
Io
ve-c2
(172.17.0.3/16)
ve-c2
(172.17.0.2/16)
Default/Root Global Namespace
Container 3
Container 4
172.16.0.0
172.16.1.0
172.16.2.0
10.0.0.27
10.0.0.0/24
docker0

55. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
TASK NETWORKING - AWSVPC
Default/Root Global Namespace
docker0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
1. Pre ENI Attachment: The
Primary ENI (eth0) is in the
default namespace
2. ENI Attachment: The new
ENI (eth1) is in the default
namespace
3. ENI Provisioned: The ECS Agent
invokes CNI plugins to move the
new ENI into a new namespace and
configure it with addresses and routes
Default/Root Global Namespace
docker0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
eth1
Default/Root Global Namespace
ecs0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
docker0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
ve-c1

56. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
TASK NETWORKING
Default/Root Global Namespace
ecs0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
docker0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
ve-c1
Default/Root Global Namespace
ecs0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
docker0
Io
eth0
172.16.0.0
172.16.1.0
172.16.2.0
ve-c1
10.0.0.27
10.0.0.0/24
10.0.0.29
10.0.0.0/24
10.0.0.26
10.0.0.0/24
10.0.0.28
10.0.0.0/24
Task NamespaceTask Namespace

57. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.

58. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.

59. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
“Run Kubernetes for me.”

60. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
“Native AWS Integrations.”

61. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
”An Open Source Kubernetes Experience.”

62. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
=
+
E L A S T I C C O N T A I N E R S E R V I C E F O R K U B E R N E T E S
(EKS)

63. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
mycluster.eks.amazonaws.com
Availability
Zone 1
Availability
Zone 2
Availability
Zone 3
Kubectl

64. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
GENERALLY
AVAILABLE
NOW!

65. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
In Summary
• Docker allows you to easily run different code across different machines in a
standardized, easily defined environment
• Amazon Elastic Container Service allows you to schedule and run Docker containers on
AWS
• Amazon Elastic Container Service for Kubernetes is a managed service for running
Kubernetes on AWS
• AWS Fargate is a technology for Amazon ECS and EKS that allows you to run
containers without having to manage the underlying infrastructure
• Amazon Elastic Container Registry is a secure, private registry for Docker container
images

66. ©2017, AmazonWebServices, Inc. or its Affiliates. All rights reserved.
Thank you!
Let’s
build!