aws / aws/containers-roadmap

[ECS] [request]: ENI trunking support on Windows container instances

Open
#1,490 1 comment 19 reactions 0 assignees View on GitHub
ECS Proposed Windows
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
[Elastic network interface trunking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-instance-eni.html) support on Windows container instances

**Which service(s) is this request for?**
ECS (although it might also be required for Fargate)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

In July 2021, AWS launched the support of the _awsvpc_ network mode for Windows workloads running in Amazon ECS. The benefits of this are described in [this Amazon blog](https://aws.amazon.com/blogs/containers/getting-started-with-task-networking-on-amazon-ecs-with-windows-containers/). However, because the limit on the number of network interfaces that can be attached to an Amazon EC2 instance is so low, we are unable to switch over to the _awsvpc_ network mode without spreading our tasks over a drastically increased number of container instances. This would be very costly for us, especially with these being Windows instances.

[ENI trunking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-instance-eni.html) would allow us to maintain our current task density, but it is not supported on Windows container instances.

The impact of not using the _awsvpc_ network mode is that we continue to lack the fine-grained access control between our ECS tasks and our RDS instances, as described in https://github.com/aws/containers-roadmap/issues/907. In short, the _awsvpc_ network mode is not of much use without ENI trunking.

**Are you currently working around this issue?**
Right now, no. Utilisation and cost control is more important at present, so all services running on all EC2 container instances in the cluster can connect to any RDS instance.

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked Amazon ECS ENI trunking documentation and the awsvpc Windows container networking blog. The request concerns adding ENI trunking support for Windows container instances, potentially including Fargate. Done would mean Windows ECS workloads can use awsvpc with ENI trunking without the stated task-density limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, networking, operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.