Under the Hood of Amazon EC2 Container Service • Hacker News Board

Re: Under the Hood of Amazon EC2 Container Service

#31

Post by nogox » Tue, Jul 21, 2015, 3:57 PM UTC

werner wrote: post #22

samstave wrote: post #15

The biggest issue that I had with ECS is that you need to initially create EC2 instances to put into your ECS cluster, using the AMI such that they have the ECS agent on them... BUT you have to prescale that cluster manually thereafter. In the task definition - it would be MUCH better if you could select the EC2 instance type you want, collect them in an ASG and have the task slicing scale the ASG accordingly. Right…

Nope, we have built a new scheduler for you that will allow placement over multiple AZ's, replace failed containers, allow them to connect to ELB's, etc.

check out hyper.sh, this is the future of public CaaS. After all, you don't need EC2 to host your containers, if you can run them directly with a hypervisor.

Re: Under the Hood of Amazon EC2 Container Service

#32

Post by nogox » Tue, Jul 21, 2015, 3:59 PM UTC

osipov wrote: post #16

samstave wrote: post #15

The biggest issue that I had with ECS is that you need to initially create EC2 instances to put into your ECS cluster, using the AMI such that they have the ECS agent on them... BUT you have to prescale that cluster manually thereafter. In the task definition - it would be MUCH better if you could select the EC2 instance type you want, collect them in an ASG and have the task slicing scale the ASG accordingly. Right…

I've been using IBM Container Service. They have Docker containers running on bare metal servers with a free tier and a trial account for 30 days. With respect to clusters, you can set up a scalable group with min/max sizes and they'll take care of routing across the containers in the group.

How do they handle the isolation in a multi-tenant environment?

Re: Under the Hood of Amazon EC2 Container Service

#33

Post by TheIronYuppie » Tue, Jul 21, 2015, 5:29 PM UTC

Rapzid wrote: post #28

A glaring gap currently is security. Per-container IAM roles would go a long way IMHO, but that still leaves "other" secret management which is a PITA. Other options such as kubernetes lack the AWS/ELB integration; all seem to be lacking a good security management model.

FWIW, Kubernetes provides its own load balancer, which you can put behind ELB.

Other than that, Kubernetes works on AWS out of the box, with a one line setup.

Full disclosure: I work at Google, on Kubernetes.

Re: Under the Hood of Amazon EC2 Container Service

#34

Post by samstave » Tue, Jul 21, 2015, 5:40 PM UTC

djb_hackernews wrote: post #21

samstave wrote: post #20

Earlier quoted context omitted.

Heh, yeah basically you can create an asg, but ecs has no trigger to scale it based on the number of task containers you attempt to launch on the cluster.... There is a workaround, apparently, which is to create a custom metric but aws says this has not been tested to their knowledge... So any asg will be "static" implicitly...

That is definitely inaccurate. We have asgs that scale based on cpu load and custom cloudwatch metrics. With ecs I can imagine a metric that keeps track of the number of tasks and hosts, or ports used or something. I think asg is the perfect tool to use to auto scale ecs clusters.

Ah, true... you could create custom metrics to trigger on... I was mentioning from the native ECS standpoint...

Also - all my information is only from the one day container session I attended at the pop-up last week... so I am certainly not an SME on ECS.

Re: Under the Hood of Amazon EC2 Container Service

#35

Post by samstave » Tue, Jul 21, 2015, 5:40 PM UTC

werner wrote: post #22

samstave wrote: post #15

The biggest issue that I had with ECS is that you need to initially create EC2 instances to put into your ECS cluster, using the AMI such that they have the ECS agent on them... BUT you have to prescale that cluster manually thereafter. In the task definition - it would be MUCH better if you could select the EC2 instance type you want, collect them in an ASG and have the task slicing scale the ASG accordingly. Right…

Nope, we have built a new scheduler for you that will allow placement over multiple AZ's, replace failed containers, allow them to connect to ELB's, etc.

Thanks - All my info is from the containerization pop-up you guys held last week in SF... The presenters did not seem to know about this.

Re: Under the Hood of Amazon EC2 Container Service

#36

Post by Rapzid » Sun, Jul 26, 2015, 11:13 PM UTC

TheIronYuppie wrote: post #33

Rapzid wrote: post #28

A glaring gap currently is security. Per-container IAM roles would go a long way IMHO, but that still leaves "other" secret management which is a PITA. Other options such as kubernetes lack the AWS/ELB integration; all seem to be lacking a good security management model.

FWIW, Kubernetes provides its own load balancer, which you can put behind ELB. Other than that, Kubernetes works on AWS out of the box, with a one line setup. Full disclosure: I work at Google, on Kubernetes.

I'm not sure that's what I would call an integration... AWS provides for easy host management and elastic scaling traditionally through the integration of the ELB with autoscale groups, and now with life-cycle hooks. I'm not aware that kubernetes integrates with this stuff in any way or provides a sufficient alternative. Reading through the documentation I was not able to find information about connection draining on rolling updates, taking hosts out of service for maintenance/scaling/replacement, and so on. I am aware that kubernetes will run on AWS now and there is a guide for setting it up.

However this really wasn't the point of my comment, which is that security for application secrets(and AWS API access) is currently a sore spot. It would be nice if kubernetes would adopt some of hashicorps stuff like consul, templates, and vault. Maybe that's too far up the container stack though and a popular bundling of technologies will appear.