aws / aws/containers-roadmap

[ECS, Fargate]: ecs task describe output with image layer hash

Open
#83 0 comments 4 reactions 0 assignees View on GitHub
Fargate Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**

I'd like ecs task output to contain actual image layer hashes. An image tag is symbolic and over writable, and doesn't serve as a useful mechanism for knowing what exactly is running in a fleet of containers, when inspecting the fleet via the ecs api.

**Which service(s) is this request for?**

ECS, Fargate primarily. Kubernetes already includes the image hash for the output.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

At the moment when using ecs outside of convention (git or version image tags, etc) adopted by individual app teams its rather hard to get any apriori sense of the exact sw versions in a running task. When instituting policy across app teams, this uncertainty wrt to whats actually running is problematic.

The goal is to be able to know if there are extant vulns in an environment, although the more generalized case is to know exactly which version/sw is running across ecs clusters. The impact is not being able to verify the identity/version of running sw components. One mitigation would be dictating pipeline and image publishing procedures, which while useful is fairly drastic compared to simply having the infrastructure returning this information on api calls.

For ecs on ec2, various system agents are able to collect this metadata directly from the docker daemon api, for fargate this isn't an option.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.