Ravindra BagaleCourses & study guides मराठी Track your progress

Deploy a Docker Container on ECS Fargate Step by Step

By , trainer LinkedIn Last updated:

Theory is done. Now put a real nginx container on Fargate in ap-south-1. You will use ECR, a cluster, a task definition and a service with a public IP. Delete everything at the end.

What you'll learn in this chapter

  • Push or pull an image via ECR
  • Create cluster, task definition, Fargate service
  • Open port 80 and hit the public IP
  • Clean up so billing stops

1. Before you start

Why do we need this?

Fargate + public IP + NAT can surprise a bill if you forget the service overnight.

What is it?

  • Region: ap-south-1 (Mumbai).
  • IAM user/role that can use ECS, ECR, IAM pass-role, VPC.
  • Optional: Docker on your laptop. Or use the public nginx image from Docker Hub via ECS (no local Docker).
  • This lab uses the public nginx:stable image for speed. Production should use ECR.

Cost warning

Fargate bills per second while the task runs. Delete the service and cluster when done. Do not leave desired count at 1 overnight.

2. Lab: click by click

How to do it (step by step)

A. Networking check

  1. Console → VPC → note your default VPC and a public subnet (has route to Internet Gateway).
  2. Security group: create ecs-nginx-sg. Inbound: TCP 80 from My IP (or 0.0.0.0/0 for a 10-minute lab only). Outbound: all.

B. ECS cluster

  1. Console → Elastic Container Service → Clusters → Create cluster.
  2. Name: lab-fargate-cluster. Infrastructure: AWS Fargate (serverless). Create.

C. Task definition

  1. Task definitions → Create new task definition.
  2. Family: lab-nginx. Launch type: AWS Fargate. OS: Linux. CPU: 0.25 vCPU. Memory: 0.5 GB.
  3. Task role: none for this lab. Task execution role: create new / use default ecsTaskExecutionRole (pulls images + logs).
  4. Container — Add container. Name: web. Image URI: public.ecr.aws/nginx/nginx:stable (or nginx:stable).
  5. Port mappings: container port 80, protocol TCP, app protocol HTTP.
  6. Create.

D. Service

  1. Open cluster → Services → Create.
  2. Compute: Fargate. Task definition: lab-nginx latest. Service name: lab-nginx-svc. Desired tasks: 1.
  3. Networking: default VPC, one public subnet, security group ecs-nginx-sg. Public IP: Turn on.
  4. Load balancer: none (lab). Create. Wait until running count = 1.

E. Verify

  1. Tasks tab → open the task → Configuration → Public IP.
  2. Browser: http://PUBLIC_IP/ — expect nginx welcome page.
  3. Or: curl -sI http://PUBLIC_IP/ | head -5 — expect HTTP/1.1 200.

Cleanup (required)

  1. Service → Update → desired tasks 0 → Update. Wait running 0. Then Delete service.
  2. Delete cluster lab-fargate-cluster.
  3. Optional: deregister task definition revisions. Delete security group if unused.
  4. Billing → confirm no ongoing Fargate charges after ~1 hour.

3. Production notes

  • Push your own image to ECR; never rely on Docker Hub rate limits.
  • Put an ALB in front; do not expose task public IPs.
  • Send logs to CloudWatch Logs from the task definition.
  • Use least-privilege task role for S3/DynamoDB calls.

4. Interview angles

Q. Why public IP on for this lab?

Without ALB, you need a public IP to reach the task.

Q. What does the execution role do?

Pull image from registry and write logs.

Q. Desired count 0?

Stops tasks; billing for those tasks stops.

Q. CPU 0.25 / 0.5 GB valid?

Yes — Fargate has allowed CPU/memory pairs.

Try at home

  1. Push a custom HTML image to ECR and swap the image URI.
  2. Add an ALB and remove the public IP.

In short

  1. ECR/image → task definition → Fargate service.
  2. Public IP or ALB to reach the app.
  3. Always scale to 0 and delete after labs.

Practice Tasks

About this scenario

Ahmednagar Sugar Co-op is a sugar co-operative business in Ahilyanagar. Balasaheb Pawar looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 10

Easy Create an ECS cluster

Why: A cluster is the logical home for your services and tasks.

What to do: Create an ECS cluster named nagarsugar-cluster.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Create an ECR repository

Why: ECR stores your Docker images privately inside AWS.

What to do: Create an ECR repository named nagarsugar/web.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy List running tasks

Why: See which tasks are running in a cluster.

What to do: List the tasks in cluster nagarsugar-cluster.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Register a task definition

Why: The task definition says which image, CPU, memory and ports a container uses.

What to do: Register the task definition in taskdef.json.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Pull images from one repository

Why: CI or servers should pull only the images they run.

What to do: Allow ecr:BatchGetImage and ecr:GetDownloadUrlForLayer on arn:aws:ecr:ap-south-1:131959625285:repository/nagarsugar/web, plus ecr:GetAuthorizationToken on *.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Medium Scale a service

Why: Change desired count to run more copies of the container.

What to do: Set service web in cluster nagarsugar-cluster to 4 tasks.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Trust policy for an ECS task role

Why: The trust policy says WHO may take the role.

What to do: Write a trust policy that lets ecs-tasks.amazonaws.com assume the role.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Medium Redeploy a service

Why: force-new-deployment restarts tasks so they pull the latest image.

What to do: Force a new deployment of service web in cluster nagarsugar-cluster.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Get the ECR login password

Why: Docker needs a short-lived password before it can push to ECR.

What to do: Get the ECR login password for ap-south-1.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Create a Fargate service

Why: A service keeps the desired number of tasks running and replaces failed ones.

What to do: In cluster nagarsugar-cluster, create service web using task definition nagarsugar-web:1, 2 tasks, launch type FARGATE, network config from net.json.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Revision card: Push an image to ECR. ECS needs an image URL AWS can pull. A laptop-only Docker image is not enough. Amazon ECR is a private container registry in your account. Tag and push with docker, then point the task definition at the URI. Create repo → aws ecr get-login-password | docker login → docker tag → docker push in ap-south-1. Task definition image = 123.dkr.ecr.ap-south-1.amazonaws.com/yourname-nginx:latest.
Revision card: Push an image to ECR · Download PNG · Open card page
Revision card: Fargate service click path. Without a service, a one-off task dies and nothing brings it back. Cluster + Fargate task definition + service with desired count 1 and a public IP (lab) or ALB (prod pattern). Console: create cluster → task definition (0.25 vCPU / 0.5 GB) → service Fargate → assign public IP for the lab. Browser opens the public IP on port 80 and shows the nginx welcome page.
Revision card: Fargate service click path · Download PNG · Open card page
Revision card: Clean up ECS so you stop paying. Forgotten Fargate tasks and ALBs keep billing after the lab. Scale desired count to 0 or delete the service, then delete cluster extras, unused task definitions, and the ECR images you do not need. Update service desired 0 → delete service → delete cluster → delete ECR repo (optional) the same day. Cost Explorer shows near-zero Fargate after cleanup; no running tasks in the cluster.
Revision card: Clean up ECS so you stop paying · Download PNG · Open card page
Interview card: Why ECR instead of only Docker Hub?. ECR is private in your account, integrates with IAM, and sits next to ECS in-region. Pull permissions are IAM roles, not a Hub password baked into hosts. Push to ap-south-1 ECR; task definition uses that URI.
Interview card: Why ECR instead of only Docker Hub? · Download PNG · Open card page
Interview card: How do you stop Fargate charges after a lab?. Set desired count to 0 or delete the service; remove ALB/NAT if you created them. Idle desired count >0 still runs tasks and bills vCPU/memory. UpdateService desiredCount=0 the same day; confirm no running tasks.
Interview card: How do you stop Fargate charges after a lab? · Download PNG · Open card page

More cards: Ravi Sir's Cards.