AWS Fargate - pulling from a private repo

Question

When searching for this it yields how to do this using ECS. This requires either putting a config file in a particular directory or setting env variables, neither of which are possible when using Fargate as it's serverless.

I feel as if I'm missing something here, anyone have any ideas?

Thanks!

Answer 1

update As of 2018 This answer is no longer valid; You can now use private registries. see https://stackoverflow.com/a/52267257

---

I found http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definitions

• The Fargate launch type only supports images in Amazon ECR or public repositories in Docker Hub.

Which seems to imply it's currently not supported.

The easiest workaround would be to upload a copy of the image to ECR.

Answer 2

AWS just released that feature for Fargate: you can use any private registry of your choice with Fargate or EC2 launch types. You will first store your private registry credentials in AWS Secrets Manager. You will then provide the secret-manager ARN or the secret name as container level parameter while registering your task definition. This feature requires the Fargate platform version 1.2.0.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html

Answer 3

PrivateLinks is now available, for both ECS & ECR

With PrivateLinks you can register and operate your EC2 instance and Fargate to ECS cluster without public ip and can also access images from ECR.

Endpoint Required:

EC2 Launch type:

For ECS:

com.amazonaws.region.ecs-agent
com.amazonaws.region.ecs-telemetry
com.amazonaws.region.ecs

For ECR:

com.amazonaws.region.ecr.dkr
com.amazonaws.region.ecr.api
com.amazonaws.region.s3 (S3 gateway endpoint)

Fargate Launch Type:

For ECS: Just needs ECR & cloudwatch endpoints (mentioned below)

For ECR:

Fargate Launch Type:

com.amazonaws.region.ecr.dkr 
com.amazonaws.region.s3 (S3 gateway endpoint)

CloudWatch

Additionally if you use awslogs driver, you have add cloudwatch endpoint as well. com.amazonaws.region.logs.

you can check details @ https://stackoverflow.com/a/54393281/10976464