aws / aws/aws-cdk

core: push SOCI index when publishing docker image assets

Open
#26,413 12 comments 17 reactions 0 assignees View on GitHub
@aws-cdk/core effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Recently Seekable OCI (SOCI) has become supported on ECS Fargate ([blog](https://aws.amazon.com/blogs/aws/aws-fargate-enables-faster-container-startup-using-seekable-oci/)) to launch Fargate tasks faster.

> Amazon ECS tasks on Fargate that use Linux platform version 1.4.0 can use Seekable OCI (SOCI) to help start tasks faster. With SOCI, containers only spend a few seconds on the image pull before they can start, providing time for environment setup and application instantiation while the image is downloaded in the background. This is called lazy loading. When Fargate starts an Amazon ECS task, Fargate automatically detects if a SOCI index exists for an image in the task and starts the container without waiting for the entire image to be downloaded.
https://docs.aws.amazon.com/AmazonECS/latest/userguide/container-considerations.html#fargate-tasks-soci-images

It can help if CDK automatically builds and publishes a SOCI index for a docker image assets.

### Use Case

To easily publishes SOCI index from CDK, and eventually increasing the speed of Fargate cold start for large container images.

### Proposed Solution

**NOTE**: I published an experimental construct for this feature: https://github.com/aws/aws-cdk/issues/26413#issuecomment-1665509747

```ts
// install the package by npm install deploy-time-build
import { SociIndexBuild } from 'deploy-time-build;

const asset = new DockerImageAsset(this, 'Image', { directory: 'example-image' });
SociIndexBuild.fromDockerImageAsset(this, 'Index', asset);
// The SOCI index for the docker image will be built and deployed during CFn deployment!
```

Run [soci-snapshotter](https://github.com/awslabs/soci-snapshotter) locally on cdk deploy, and publish the artifact to ecr. Whether cdk publishes SOCI index or not should be optional because sometimes it will slow down fargate startup time especially for small images ([ref](https://twitter.com/apparentorder/status/1681321222225928193)).

### Other Information

There is already a solution to automatically build and push SOCI index when an image is pushed to ECR.

https://aws-ia.github.io/cfn-ecr-aws-soci-index-builder/

Because this solution publishes a SOCI index asynchronously, sometimes the index is not ready yet when a Fargate task launches. The CDK solution might be better in that we can easily set dependencies between assets and ECS task definition, which allows to wait an update of task definition until the corresponding SOCI index is available.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.87.0

### Environment details (OS name and version, etc.)

macOS

Contributor guide

Open the contributing guide

Research direction

Start by tracing how DockerImageAsset publishes image assets and how the proposed SociIndexBuild construct uses soci-snapshotter and ECR. Define an optional path that publishes the SOCI index during deployment and supports dependencies from the image asset to consuming resources; done means the index is available before a dependent task launches.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.