[ECS][Request] allow setting runtime for agent
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Summary
I'd like to run my ECS task containers on top of gVisor. It seems that this was possible in the past on ECS using an approach like this one:
https://aarongorka.com/blog/gvisor-on-ecs/
Notably the author had to disable the init system and ran the ecs-agent container through docker directly, and also had to manually set some volume binds and other settings. I tried to follow the same approach (updating to include new binds since the post was written, add the NET_ADMIN/SYS_ADMIN capabilities, etc), but in the end it still fails because ecs-agent added an explicit check for not being run directly:
https://github.com/aws/amazon-ecs-agent/blob/7fb101189ae57170a2cc2976d086bec5a4146b97/agent/app/agent_unix.go#L65-L73
It would be great if amazon-ecs-init allowed specifying the runtime so I could run task containers on gVisor and let ecs-agent continue to use runc
Contributor guide
Research direction
Start with the linked agent_unix.go check and investigate how amazon-ecs-init configures the ecs-agent container and task runtime. Define how a configurable gVisor runtime would apply to task containers while ecs-agent continues using runc, then verify the behavior against the existing ECS initialization flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100