Container Image Support in AWS Lambda
By: Myung Kim
Tags: Lambda, AWS, Serverless, Docker, AWS Lambda

AWS has a growing number of serverless services that enable development teams to build agile applications rapidly, leaving AWS responsible for managing and operating servers and infrastructure. AWS Lambda takes care of running your application code and scales the code with high availability, with pay-per-use pricing.

With today’s AWS re:Invent announcement of Container Image Support in AWS Lambda, developers can build new applications as functions using familiar container tooling, which will provide a seamless way to write code and test locally. Enterprise customers can use a consistent set of tools with both containerized applications and Lambda function for central application and security governance requirements, such as security scanning and image signing.

Function packaged and deployed as container image.

Once the container image is pushed to the container registry (ECR) as the versioned artifact, the same immutable container image can be promoted to the production environment after successful automated tests. The immutability of the container provides safe and predictable deployment since the container image will behave the same way in the production as it did on the developer’s computer.

Immutable container image provides safe and predictable deployment.

AWS offers two options to package a function as a container image

The first is to use an AWS-provided, open-sourced Lambda base image, as shown here. As you can see, it’s simple to package your function as a container image. The AWS-provided base images will be patched and updated regularly. Here is a link to AWS Lambda’s provided base name and location in Docker Hub and newly announced AWS Elastic Container Registry Public Gallery.

First option AWS Lambda provided base image. Example for nodejs shown.

Currently supported runtimes are dotnetcore2.1, dotnetcore3.1, go1.x, java8, java8.al2, java11, nodejs12.x, nodejs10.x, python3.8, python3.7, python3.6, python2.7, ruby2.5 and ruby2.7.

The second option is to bring your private custom or enterprise base image and install the open-sourced AWS Lambda Runtime Interface Client, which will make any custom image compatible with Lambda’s Runtime API. This option requires more work than the first, but it gives you the flexibility to use any base image and configure any dependencies for the application.

Local Testing of Lambda Function Packaged in Docker Image

In addition to many open source serverless container tools, such as AWS SAM or Docker Desktop, AWS Lambda also open sourced the AWS Lambda Runtime Interface Emulator (RIE) which allows developers to locally test any Lambda function container image.

The Lambda RIE is a lightweight web server that coverts HTTP requests to AWS Lambda JSON Event to invoke the Lambda handler in the container image. The Lambda RIE will maintain functional parity with the Lambda Runtime API in the cloud.

If you used the first option to package your function as a container image, the Lambda RIE is included in the image. So, all you need to test the Lambda function is to use the familiar Docker run command, as shown below. Please refer to how to download and add the RIE to your image if you are using the second option.

The function can be invoked via sending Lambda Runtime API request.

Create and Deploy Function using Docker Image

Once a function is packaged as a container image and uploaded to ECR, the Lambda function can be created using the new ImageUri code option instead of specifying S3 options.

Also, SAM template supports specifying a container image via an ImageUri option.

New Possibilities

Container Image Support opens the possibility of building machine learning or data intensive workloads as functions packages since container images may be up to 10GB in size. Customers are already leveraging, or in the process of building, machine learning as APIs for many use cases in their businesses. With this new feature — plus increased Lambda cpu and memory up to 10GB in size — a machine learning model can be packaged in a container image along with the function, and integrated with AWS API Gateway to provide a machine learning API. When a request is made, the function deployed as container image is executed with sub-second autoscaling. The function will prepare the input, load the model, then compute the model output, and return the inference result.

Customers can also take advantage of 140 native service integrations. For example, when a picture is uploaded to an S3 bucket, a Lambda function can be invoked to determine how to classify the picture. When an improved machine learning model is available, it’s only a single function deployment away.

New Container Image Support in AWS Lambda provides a more flexible way to develop, test, and deploy Lambda functions. Since the function packaged as a container image will include the application code and all the runtime and libraries dependencies, the same container image’s function can be deployed and consistently promoted to the production environment.