aws / aws/containers-roadmap

[ECS][Request] allow setting runtime for agent

Open
#673 1 comment 8 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Summary
I'd like to run my ECS task containers on top of gVisor. It seems that this was possible in the past on ECS using an approach like this one:
https://aarongorka.com/blog/gvisor-on-ecs/

Notably the author had to disable the init system and ran the ecs-agent container through docker directly, and also had to manually set some volume binds and other settings. I tried to follow the same approach (updating to include new binds since the post was written, add the NET_ADMIN/SYS_ADMIN capabilities, etc), but in the end it still fails because ecs-agent added an explicit check for not being run directly:
https://github.com/aws/amazon-ecs-agent/blob/7fb101189ae57170a2cc2976d086bec5a4146b97/agent/app/agent_unix.go#L65-L73

It would be great if amazon-ecs-init allowed specifying the runtime so I could run task containers on gVisor and let ecs-agent continue to use runc

Contributor guide

Open the contributing guide

Research direction

Start with the linked agent_unix.go check and investigate how amazon-ecs-init configures the ecs-agent container and task runtime. Define how a configurable gVisor runtime would apply to task containers while ecs-agent continues using runc, then verify the behavior against the existing ECS initialization flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.