5 ms·

AWS EC2 Container Service

350 points by nitinag 12y ago

hammerdr 12y ago
Anyone have any insight about if this handles service discovery? It claims "cluster management" which usually means discovery, but there is no mention of it. Maybe Amazon is expecting you to handle that?
- zenlikethat 12y ago
  I was wondering this as well. It seems that they will provide for constraints around co-located containers (similar to pods in Kubernetes) but I'm not sure how discovery for containers scheduled across hosts is meant to take place.
- jhappoldt 12y ago
  From: https://aws.amazon.com/ecs/details/ https://aws.amazon.com/ecs/details/ ...including the Docker repository and image, memory and CPU requirements, and how the containers are linked to each other. You can launch as many tasks as you want from a single task definition file that you can register with the service. Very few details but it looks like container lifting across hosts. If so this is great news.
  - zenlikethat 12y ago
    Yes but there are a lot of ways that "the containers are linked together" could be implemented and some of them e.g. key value store require modifying application code quite a bit whereas e.g. DNS does not.
    - vidarh 12y ago
      If you want DNS, running e.g. Registrator would be easy enough, and have the added bonus of not tieing your service discovery to AWS.
    - derefr 12y ago
      Wasn't there just an AWS announcement yesterday about the ability to register VPC-private DNS records in Route 53? It screamed "SkyDNS competitor" to me but I couldn't figure out what Amazon wanted such a thing for. Makes sense now.
      - donavanm 12y ago
        Route 53 launched private (vpc) dns last week. Its actually a common pattern to manage ec2 instances via dns records. Many people had built this on top of the public route53 offering, see zonify from airbnb as an example. Private dns improves on that model as the vpc instances never have to communicate with the public internet now.
- timdorr 12y ago
  You install an ECS agent on each physical server that runs alongside dockerd and reports state back to the central ECS API. You can query that API for service discovery.
nitinag 12y ago
Direct link to product as well: http://aws.amazon.com/ecs/ http://aws.amazon.com/ecs/
St-Clock 12y ago
Security-wise, if I understand correctly, this is a very interesting offering. 1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers. 2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers. #2 is what worried me the most in other container service offerings. It's easy to overlook protecting your internal ip when you manage VMs, it's even easier (and expected) when you deploy containers.
- kalgen 12y ago
  These are also properties of Google Container Engine. Which other container service offerings were you thinking of?
  - dividuum 12y ago
    Digital Ocean has something called "Private Networking" that's internal to the data center but shared with all other customers. It's not obvious from reading the website that this is the case.
    - estsauver 12y ago
      I actually think they're almost intentionally a touch deceptive. "Private" is a really loaded term to use there.
      - SoreGums 12y ago
        Not really, common to refer to Private IP's as "private IP address space" as per RFC 1918(IPv4)/RFC 4193(IPv6). If a user of the service is wanting to get on board, it is their responsibility to ensure what they think is accurate or not.
      - inopinatus 12y ago
        When a door is marked "Private", then the room beyond is generally a shared space for all those authorized to access.
garblegarble 12y ago
Weird, I'm getting a 404 when visiting this page, did Amazon pull it?
- cyanbane 12y ago
  Same 404, I wonder if not at all CDN locations yet?
- pm90 12y ago
  working fine for me
sshillo 12y ago
I wonder if this is built off apache mesos
SEJeff 12y ago
So Azure, GCE, and now EC2 all support docker natively. Sorry Canonical and LXD, but docker has basically won at this point. There simply isn't a good reason to "compete" when you can just add features to docker at this point.
- deleted 12y ago
  [deleted]
  - pliu 12y ago
    Docker is built on LXC, Linux containers. LXD is a new thing from Canonical, a hypervisor designed especially for containers that is supposed to guarantee hardware isolation.
    - waffle_ss 12y ago
      > Docker is built on LXC, Linux containers Nope, it currently defaults to libcontainer[1], not LXC, but through the use of execution drivers[2] you can still use LXC if you want to. [1]: https://github.com/docker/libcontainer https://github.com/docker/libcontainer [2]: http://blog.docker.com/2014/03/docker-0-9-introducing-execution-drivers-and-libcontainer/ http://blog.docker.com/2014/03/docker-0-9-introducing-execut...
    - general_failure 12y ago
      Lxc is user land tooling
  - SEJeff 12y ago
    Incorrect, docker is built ontop of Linux kernel namespaces and cgroups. The first backend was LXC (notice the C and not D). The current backend is libcontainer, which is a native golang re-implementation (more or less) of LXC. There is a docker backend for LXC, but it is not the default and is likely not used super heavily. Note that there isn't really a Linux kernel feature called LXC. The LXC userspace just ties all of the namespacing and cgroup functionality into 1 coherent super-chroot style environment. That is the same as docker does with libcontainer. http://www.infoq.com/news/2014/03/docker_0_9 http://www.infoq.com/news/2014/03/docker_0_9
incision 12y ago
I'm disappointed that this requires an invite, particularly so close after Container Engine which I was able to try out immediately while still watching Cloud Platform Live the other day. Is this typical for new AWS offerings? It makes me wonder if it's something that truly isn't ready for prime time, but is being rushed / forced by the mounting Docker hype and GKE announcement.
- swordwield 12y ago
  Considering they've been tweeting about it [1] since before their competitors announced things I'd say it's unlikely to be a "response". It's far more likely that Docker has now been out long enough for the various providers to build services around it. AWS already had some docker support built in in April [2]. It's also pretty common to release services as previews. GCE lists theirs as an Alpha quality product. [1] https://twitter.com/jeffbarr/status/529493907839533056 https://twitter.com/jeffbarr/status/529493907839533056 [2] http://blog.docker.com/2014/04/aws-elastic-beanstalk-launches-support-for-docker/ http://blog.docker.com/2014/04/aws-elastic-beanstalk-launche...
  - bashtoni 12y ago
    Given that kubernetes (the project behind GCE) was open sourced in early June, I hardly think a tweet from a week and a half ago shows it's not a response to Google.
    - gruvector 12y ago
      He also mentions the elastic beanstalk support for Docker from April. It's quite obvious that everyone has been working on Docker support for a while now anyway.
- jakozaur 12y ago
  It's fairly typical. Though I usually get preview to any service reasonable fast just by clicking on their website. E.g. Amazon Kinesis: Preview 14 Nov 2013: http://aws.amazon.com/blogs/aws/amazon-kinesis-real-time-processing-of-streamed-data/ http://aws.amazon.com/blogs/aws/amazon-kinesis-real-time-pro... Got access less than week from that. GA 16 Dec 2013: http://aws.amazon.com/about-aws/whats-new/2013/12/16/amazon-kinesis-available-for-all-customers/ http://aws.amazon.com/about-aws/whats-new/2013/12/16/amazon-...
deleted 12y ago
[deleted]
ing33k 12y ago
one more reason to use docker .
waitingkuo 12y ago
When can we start to use this service?
Animats 12y ago
"All problems in computer science can be solved by another level of indirection" - David Wheeler That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canned AWS instances to choose from. So now we have another level of indirection, "containers". Next I expect we'll have container logistics management startups. These will store your container in a cloud-based "warehouse", and will continuously take bids for container execution resources. Containers will be automatically moved around from Amazon to Google to Rackspace, etc. depending on who's offering the lowest bid right now.
- tjbiddle 12y ago
  It's amazing to me how much easier the process is for this nowadays. We really live in an exciting time.
- eldavido 12y ago
  It's more like a ping-pong. Things start off simply, but over time as the layers of abstraction pile up, things become brittle and unworkable. I view containers as more of a reworking of a key computational abstraction (VMs) than an evolution of them. We finally have operating systems with enough inter-process isolation, sufficiently capable filesystems (layering), etc. that we can throw out 80% of the other unnecessary junk of VMs like second kernels, duplicate schedulers, endless duplication of standard system libraries, etc. So it's more like we've hacked/refactored virtualization into a more usable state, and gotten rid of a lot of useless garbage that it turns out we didn't actually need. It's a lot like how a big software system evolves, now that I think about it.
  - jobposter1234 12y ago
    I'm genuinely curious, although a bit naive WRT containers. Outside of an aesthetic preference (for being able to remove 80% unnecessary cruft), what is the advantage of containers? I was under the impression that VM overhead was marginal in terms of today's computing. I ask because I'm familiar with VMs, having worked with them extensively for a number of years. VMs work quite well for any application I've needed, so what would be the benefit of switching to containers? I've got lots to do, and lots to learn, but I can't see learning containers (and being out of sync with the rest of my coworkers) being a priority. But I'm willing to change my mind if there's a concrete benefit. Right now, VMs work just fine, but maybe there's something I'm missing...
gtaylor 12y ago
Is anyone else seeing a blank confirmation page when trying to sign up? http://i.imgur.com/faztegP.png http://i.imgur.com/faztegP.png
- sync 12y ago
  I got that too. Pretty awesome. May not be production ready for quite some time...
- zenlikethat 12y ago
  I got this too.
j2d3 12y ago
This destroys heroku, right?
- general_failure 12y ago
  No, I think deis and dokku
  - j2d3 12y ago
    Them too, but heroku runs on aws and basically provides this, too, but instead of free, it's very very expensive
    - general_failure 12y ago
      It's expensive comparatively. The convenience heroku provides is vastly overweighs the price.
beat 12y ago
Docker in general is just another swing of the granularity pendulum. Since the rise of distributed environments in the late 1980s, the pendulum has swung back and forth between microservices (which become a version control tangle as they move independently) and monolithic applications (which become a bloatware problem as they have whole kitchen sinks to move around). The core problem is that software is complex, and at a certain level, you can't take complexity away - just push it around here and there. A large number of small pieces, or a small number of large pieces. Which kneecap do you want shot in? After a few years of trending toward monoliths via chef/puppet/ansible DevOps automation, Docker is going in a different direction, toward fragmented SOA. It'll go that way for a while until it becomes too painful, and then new tech will come to push us back to the monolithic approach, until that hurts too much... The good thing is, these cycles come in response to improvements in technology and performance. Our tools get better all the time, and configuration management struggles to keep up. It's awesome! Docker will rule for a while and then be passed by in favor of something new, but it'll leave a permanent mark, just as Chef did, and Maven, and Subversion, and Ant, and Make, and CVS, and every other game-changer.
jpgvm 12y ago
No mention of Elastic Load Balancing integration or even EBS integration. Thus avoiding the 2 hardest problems in container management. To make this not suck you will still need a proxy layer that maps ELB listeners to your containers and if you intend to run containers with persistent storage you are going to be in for a fun ride. Probably best to integrate functionality for interacting with storage systems into Docker itself, probably as a script hook interface similar to the way Xen works.
LeonidBugaev 12y ago
I guess it is like hosted Mesos. They provide Masters and API similar to Marathon, and you just have to run slave instances. Looks nice :)

350 points by nitinag 12y ago

Anyone have any insight about if this handles service discovery? It claims "cluster management" which usually means discovery, but there is no mention of it. Maybe Amazon is expecting you to handle that?

zenlikethat 12y ago
I was wondering this as well. It seems that they will provide for constraints around co-located containers (similar to pods in Kubernetes) but I'm not sure how discovery for containers scheduled across hosts is meant to take place.
jhappoldt 12y ago
From: https://aws.amazon.com/ecs/details/ https://aws.amazon.com/ecs/details/ ...including the Docker repository and image, memory and CPU requirements, and how the containers are linked to each other. You can launch as many tasks as you want from a single task definition file that you can register with the service. Very few details but it looks like container lifting across hosts. If so this is great news.
- zenlikethat 12y ago
  Yes but there are a lot of ways that "the containers are linked together" could be implemented and some of them e.g. key value store require modifying application code quite a bit whereas e.g. DNS does not.
  - vidarh 12y ago
    If you want DNS, running e.g. Registrator would be easy enough, and have the added bonus of not tieing your service discovery to AWS.
  - derefr 12y ago
    Wasn't there just an AWS announcement yesterday about the ability to register VPC-private DNS records in Route 53? It screamed "SkyDNS competitor" to me but I couldn't figure out what Amazon wanted such a thing for. Makes sense now.
    - donavanm 12y ago
      Route 53 launched private (vpc) dns last week. Its actually a common pattern to manage ec2 instances via dns records. Many people had built this on top of the public route53 offering, see zonify from airbnb as an example. Private dns improves on that model as the vpc instances never have to communicate with the public internet now.
timdorr 12y ago
You install an ECS agent on each physical server that runs alongside dockerd and reports state back to the central ECS API. You can query that API for service discovery.

nitinag 12y ago

Direct link to product as well: http://aws.amazon.com/ecs/ http://aws.amazon.com/ecs/

St-Clock 12y ago

Security-wise, if I understand correctly, this is a very interesting offering. 1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers. 2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers. #2 is what worried me the most in other container service offerings. It's easy to overlook protecting your internal ip when you manage VMs, it's even easier (and expected) when you deploy containers.

kalgen 12y ago
These are also properties of Google Container Engine. Which other container service offerings were you thinking of?
- dividuum 12y ago
  Digital Ocean has something called "Private Networking" that's internal to the data center but shared with all other customers. It's not obvious from reading the website that this is the case.
  - estsauver 12y ago
    I actually think they're almost intentionally a touch deceptive. "Private" is a really loaded term to use there.
    - SoreGums 12y ago
      Not really, common to refer to Private IP's as "private IP address space" as per RFC 1918(IPv4)/RFC 4193(IPv6). If a user of the service is wanting to get on board, it is their responsibility to ensure what they think is accurate or not.
    - inopinatus 12y ago
      When a door is marked "Private", then the room beyond is generally a shared space for all those authorized to access.

garblegarble 12y ago

Weird, I'm getting a 404 when visiting this page, did Amazon pull it?

cyanbane 12y ago
Same 404, I wonder if not at all CDN locations yet?
pm90 12y ago
working fine for me

sshillo 12y ago

I wonder if this is built off apache mesos

SEJeff 12y ago

So Azure, GCE, and now EC2 all support docker natively. Sorry Canonical and LXD, but docker has basically won at this point. There simply isn't a good reason to "compete" when you can just add features to docker at this point.

deleted 12y ago
[deleted]
- pliu 12y ago
  Docker is built on LXC, Linux containers. LXD is a new thing from Canonical, a hypervisor designed especially for containers that is supposed to guarantee hardware isolation.
  - waffle_ss 12y ago
    > Docker is built on LXC, Linux containers Nope, it currently defaults to libcontainer[1], not LXC, but through the use of execution drivers[2] you can still use LXC if you want to. [1]: https://github.com/docker/libcontainer https://github.com/docker/libcontainer [2]: http://blog.docker.com/2014/03/docker-0-9-introducing-execution-drivers-and-libcontainer/ http://blog.docker.com/2014/03/docker-0-9-introducing-execut...
  - general_failure 12y ago
    Lxc is user land tooling
- SEJeff 12y ago
  Incorrect, docker is built ontop of Linux kernel namespaces and cgroups. The first backend was LXC (notice the C and not D). The current backend is libcontainer, which is a native golang re-implementation (more or less) of LXC. There is a docker backend for LXC, but it is not the default and is likely not used super heavily. Note that there isn't really a Linux kernel feature called LXC. The LXC userspace just ties all of the namespacing and cgroup functionality into 1 coherent super-chroot style environment. That is the same as docker does with libcontainer. http://www.infoq.com/news/2014/03/docker_0_9 http://www.infoq.com/news/2014/03/docker_0_9

incision 12y ago

I'm disappointed that this requires an invite, particularly so close after Container Engine which I was able to try out immediately while still watching Cloud Platform Live the other day. Is this typical for new AWS offerings? It makes me wonder if it's something that truly isn't ready for prime time, but is being rushed / forced by the mounting Docker hype and GKE announcement.

swordwield 12y ago
Considering they've been tweeting about it [1] since before their competitors announced things I'd say it's unlikely to be a "response". It's far more likely that Docker has now been out long enough for the various providers to build services around it. AWS already had some docker support built in in April [2]. It's also pretty common to release services as previews. GCE lists theirs as an Alpha quality product. [1] https://twitter.com/jeffbarr/status/529493907839533056 https://twitter.com/jeffbarr/status/529493907839533056 [2] http://blog.docker.com/2014/04/aws-elastic-beanstalk-launches-support-for-docker/ http://blog.docker.com/2014/04/aws-elastic-beanstalk-launche...
- bashtoni 12y ago
  Given that kubernetes (the project behind GCE) was open sourced in early June, I hardly think a tweet from a week and a half ago shows it's not a response to Google.
  - gruvector 12y ago
    He also mentions the elastic beanstalk support for Docker from April. It's quite obvious that everyone has been working on Docker support for a while now anyway.
jakozaur 12y ago
It's fairly typical. Though I usually get preview to any service reasonable fast just by clicking on their website. E.g. Amazon Kinesis: Preview 14 Nov 2013: http://aws.amazon.com/blogs/aws/amazon-kinesis-real-time-processing-of-streamed-data/ http://aws.amazon.com/blogs/aws/amazon-kinesis-real-time-pro... Got access less than week from that. GA 16 Dec 2013: http://aws.amazon.com/about-aws/whats-new/2013/12/16/amazon-kinesis-available-for-all-customers/ http://aws.amazon.com/about-aws/whats-new/2013/12/16/amazon-...

deleted 12y ago

[deleted]

ing33k 12y ago

one more reason to use docker .

waitingkuo 12y ago

When can we start to use this service?

Animats 12y ago

"All problems in computer science can be solved by another level of indirection" - David Wheeler That's what "containers" are, of course. There's so much state in OS file namespaces that running any complex program requires "installation" first. That's such a mess that virtual machines were created to allow a custom OS environment for a program. Then that turned into a mess, with, for example, a large number of canned AWS instances to choose from. So now we have another level of indirection, "containers". Next I expect we'll have container logistics management startups. These will store your container in a cloud-based "warehouse", and will continuously take bids for container execution resources. Containers will be automatically moved around from Amazon to Google to Rackspace, etc. depending on who's offering the lowest bid right now.

tjbiddle 12y ago
It's amazing to me how much easier the process is for this nowadays. We really live in an exciting time.
eldavido 12y ago
It's more like a ping-pong. Things start off simply, but over time as the layers of abstraction pile up, things become brittle and unworkable. I view containers as more of a reworking of a key computational abstraction (VMs) than an evolution of them. We finally have operating systems with enough inter-process isolation, sufficiently capable filesystems (layering), etc. that we can throw out 80% of the other unnecessary junk of VMs like second kernels, duplicate schedulers, endless duplication of standard system libraries, etc. So it's more like we've hacked/refactored virtualization into a more usable state, and gotten rid of a lot of useless garbage that it turns out we didn't actually need. It's a lot like how a big software system evolves, now that I think about it.
- jobposter1234 12y ago
  I'm genuinely curious, although a bit naive WRT containers. Outside of an aesthetic preference (for being able to remove 80% unnecessary cruft), what is the advantage of containers? I was under the impression that VM overhead was marginal in terms of today's computing. I ask because I'm familiar with VMs, having worked with them extensively for a number of years. VMs work quite well for any application I've needed, so what would be the benefit of switching to containers? I've got lots to do, and lots to learn, but I can't see learning containers (and being out of sync with the rest of my coworkers) being a priority. But I'm willing to change my mind if there's a concrete benefit. Right now, VMs work just fine, but maybe there's something I'm missing...

gtaylor 12y ago

Is anyone else seeing a blank confirmation page when trying to sign up? http://i.imgur.com/faztegP.png http://i.imgur.com/faztegP.png

sync 12y ago
I got that too. Pretty awesome. May not be production ready for quite some time...
zenlikethat 12y ago
I got this too.

j2d3 12y ago

This destroys heroku, right?

general_failure 12y ago
No, I think deis and dokku
- j2d3 12y ago
  Them too, but heroku runs on aws and basically provides this, too, but instead of free, it's very very expensive
  - general_failure 12y ago
    It's expensive comparatively. The convenience heroku provides is vastly overweighs the price.

beat 12y ago

Docker in general is just another swing of the granularity pendulum. Since the rise of distributed environments in the late 1980s, the pendulum has swung back and forth between microservices (which become a version control tangle as they move independently) and monolithic applications (which become a bloatware problem as they have whole kitchen sinks to move around). The core problem is that software is complex, and at a certain level, you can't take complexity away - just push it around here and there. A large number of small pieces, or a small number of large pieces. Which kneecap do you want shot in? After a few years of trending toward monoliths via chef/puppet/ansible DevOps automation, Docker is going in a different direction, toward fragmented SOA. It'll go that way for a while until it becomes too painful, and then new tech will come to push us back to the monolithic approach, until that hurts too much... The good thing is, these cycles come in response to improvements in technology and performance. Our tools get better all the time, and configuration management struggles to keep up. It's awesome! Docker will rule for a while and then be passed by in favor of something new, but it'll leave a permanent mark, just as Chef did, and Maven, and Subversion, and Ant, and Make, and CVS, and every other game-changer.

jpgvm 12y ago

No mention of Elastic Load Balancing integration or even EBS integration. Thus avoiding the 2 hardest problems in container management. To make this not suck you will still need a proxy layer that maps ELB listeners to your containers and if you intend to run containers with persistent storage you are going to be in for a fun ride. Probably best to integrate functionality for interacting with storage systems into Docker itself, probably as a script hook interface similar to the way Xen works.

LeonidBugaev 12y ago

I guess it is like hosted Mesos. They provide Masters and API similar to Marathon, and you just have to run slave instances. Looks nice :)