[ECS] [Fargate]: Docker daemon parameters for cluster
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
What do you want us to build?
As part of my infrastructure, I enabled a registry-mirror for Docker in JFrog. To use the registry-mirror, I want to be able to customise the Docker daemon flags in my ECS Fargate cluster. This way, I could pass the URL to my registry mirror while creating my cluster.
**Which service(s) is this request for?**
ECS Fargate
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.
Docker changed its policies related to the amount of pull per account types. The amount of pull per 6 hours is being restricted to 100 (anonymous users) or 200 (authenticated user - free account).
As an organisation, I don't want to spread my Docker Hub credentials all over the projects pulling containers from Docker Hub. To prevent this to happen, I enabled in our JFrog artifactory a Docker registry mirror. It allows us to configure the Docker daemon of our CI / ECS EC2 clusters for pulling from our mirror and therefore using our Docker credentials only in one place.
My current issue is with ECS Fargate. It supports authentication / IAM roles for pulling from private registries but as we don't manage the daemon, we can't make the tasks pulling the container from our registry mirror.
A solution could be to prevent our users to pull public containers in their tasks. Another solution (incompatible with my constraints related to credentials) could be to authenticate the Docker client. A last solution (terrible from my point of view) could be to use a reverse-proxy for all outgoing traffic from our VPC and redirect the Docker traffic to our endpoint.
The cleanest solution, from my point of view, is to provide the `--registry-mirror` flag to the Docker daemon (or the Docker config) when creating a ECS Fargate cluster in my AWS account.
**Are you currently working around this issue?**
How are you currently solving this problem?
As for now, mainly brainstorming / experimenting.
**Additional context**
Anything else we should know?
I don't know how a Fargate task works on a ECS EC2 instance. If the Fargate task runs on one of the ECS agents attached to the cluster, is Fargate using the same Docker Daemon / Docker config as the agent? If yes, the solution could be to deploy all ECS Fargate tasks to our ECS EC2 clusters.
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
The request concerns ECS Fargate cluster creation and passing Docker's --registry-mirror flag or Docker configuration to the managed daemon. No repository files, tests, or entry points are named; first determine whether this public roadmap issue has an implementation surface, and consider the request done only when Fargate supports configuring the registry mirror.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100