ECR, ECS and Fargate

Why and what

ECR stores container images. ECS schedules tasks described by task definitions. Fargate supplies managed compute for supported tasks. An image is not a running container, a task definition is not a service, and an ECS service maintains task count rather than building your code.

Deployment lab

1. Complete the Docker chapter and build a small image locally.
2. Create a private ECR repository. Enable appropriate scanning and lifecycle retention.
3. Authenticate with temporary AWS credentials and push a versioned image tag.

aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com
docker tag academy-web:1 ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/academy-web:1
docker push ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/academy-web:1

1. Create an ECS cluster, then a Fargate-compatible task definition with supported CPU/memory, image, container port and log driver.
2. Configure the task execution role for image pull/log setup. Configure a separate task role only for APIs the application needs.
3. Create a service in selected subnets with appropriate egress to ECR/logging and inbound only from its ALB security group.
4. Attach a target group with the correct target type for task networking, then verify health.

Operational details

Private tasks need NAT or appropriate VPC endpoints for dependencies. A public subnet does not automatically give a task a public address. Image tags can move; promote immutable digests where reproducibility matters. Keep secrets in supported secret integrations, not Dockerfile layers or task-definition plaintext.

Verify and troubleshoot

Inspect service events when tasks repeatedly stop. “Cannot pull image” suggests registry permissions, wrong tag/architecture or network access. A running task with an unhealthy target often means wrong port, bind address or health path. Application code must listen on the container interface, not only loopback, when external traffic is expected.

Assignment

Deploy version 2, observe rolling replacement, and roll back to the previous known image. Delete the service/tasks and ALB when finished; remove old ECR images according to the retention decision.

Official references

ECS getting started ECR guide

Interview and revision check

How do task execution role and task role differ?

The execution role supports platform tasks such as image retrieval/log setup. The task role supplies permissions to application code.