DEV Community


ECS Networking - (awsvpc, bridge, host, none)

Hi folks, Elastic Container Service is one of the container offerings from AWS. ECS helps us to run any number of docker containers across a managed cluster of EC2 instances. It helps to isolate our workloads and helps achieve faster time to market with efficient scaling in place. It is secure and you can easily migrate your on prem container workload to ECS and back.

Let's deep dive and look into the different network types on ECS and see how they are different from one another.

We have Four Network modes in ECS:

  • awsvpc: It allocates a seperate Elastic Network Interface (ENI) to the task and also allocates a primary IPV4 address to it. The task networking behaves same as an EC2 instance networking.

Image description

In this you can see a warning which says the containers in the task will share an ENI and port mappings can only specify container ports.

Image description

We cannot set host port mappings as the network mode is awsvpc.

Once you create the service we can check in the task, an ENI is assigned to the task and all the containers inside it.

Image description

If we SSH into the instance and curl the private IP associated to the task ENI, we can access the website running on the container.
Image description

In this network mode we cannot access the website using the Task Host (EC2) Public or Private IP.

  • bridge: In Bridge Network mode, the task makes use of the built-in Docker VNet (Virtual Network) which also allows the task to communicate with other tasks.

Image description

Once we select the bridged network mode for the task we can see an associated host port mapping available with the container port.

Image description

If we check task networking the container does not have any additional network as it uses only the Docker Virtual Network.

Image description

We shall access the website running on the container using the DockerHost IP (Amazon EC2).

Image description

  • host: Host network mode facilitates the task to bypass the Docker built-in VNet (Virtual Network) and maps the container port directly to the task host (Amazon EC2) ENI. As a result, we cannot run multiple instances of the same task when Port Mappings are used and the network mode is host.

Image description

The container shall be using in this case the instance network stack.

Image description

We can access the website running on the container using the Docker Host Public IP (EC2 Instance Public IP).

Image description

  • none: Blackhole, the task does not have any external network connectivity.

Image description

You shall see a message stating that the container will not have any external connectivity in the network section of the task.

Image description

I hope this has helped you get an idea of ECS networking. Follow me for more blogs on AWS & DevOps.
Feel free to connect with me on LinkedIn!

Top comments (1)

sebaaaz profile image
Sebastián Zapata

It's very clear to me! I learned the neccesary information to choose my networks, thank you!

Timeless DEV post...

Git Concepts I Wish I Knew Years Ago

The most used technology by developers is not Javascript.

It's not Python or HTML.

It hardly even gets mentioned in interviews or listed as a pre-requisite for jobs.

I'm talking about Git and version control of course.

One does not simply learn git