ECS Networking - (awsvpc, bridge, host, none)
Tags: aws, ecs, containers, devops
Published: 2022-05-09 14:47:06

Hi folks, **Elastic Container Service** is one of the container offerings from AWS. ECS helps us to run any number of docker containers across a managed cluster of EC2 instances. It helps to isolate our workloads and helps achieve faster time to market with efficient scaling in place. It is secure and you can easily migrate your on prem container workload to ECS and back.

Let's deep dive and look into the different network types on ECS and see how they are different from one another.

##We have Four Network modes in ECS:

- **awsvpc**: It allocates a seperate Elastic Network Interface (ENI) to the task and also allocates a primary IPV4 address to it. The task networking behaves same as an EC2 instance networking. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6pmlul4iz6or8sdfpyt.png)

In this you can see a warning which says the containers in the task will share an ENI and port mappings can only specify container ports.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0qsbprq7z6lghe6tzotx.png) 

We cannot set host port mappings as the network mode is **awsvpc**.

Once you create the service we can check in the task, an ENI is assigned to the task and all the containers inside it.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/smd605rcqz81ga91nkn6.png)

If we SSH into the instance and curl the private IP associated to the task ENI, we can access the website running on the container.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4fn1xqn5f1cjvp2bw9fb.png)
  
In this network mode we cannot access the website using the Task Host (EC2) Public or Private IP.

- **bridge**: In Bridge Network mode, the task makes use of the built-in Docker VNet (Virtual Network) which also allows the task to communicate with other tasks.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/la0xac2typv9lf1be3fp.png)

Once we select the bridged network mode for the task we can see an associated host port mapping available with the container port.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4f2b175cfoxv26ucbupm.png)

If we check task networking the container does not have any additional network as it uses only the Docker Virtual Network.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i9vxqoityeubjajqc2id.png)
 
We shall access the website running on the container using the DockerHost IP (Amazon EC2).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bywnrqdt1n21rkg79stv.png)

- **host**: Host network mode facilitates the task to bypass the Docker built-in VNet (Virtual Network) and maps the container port directly to the task host (Amazon EC2) ENI. As a result, we cannot run multiple instances of the same task when Port Mappings are used and the network mode is host.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pk4g4ekw3dafy8l31ys8.png)

The container shall be using in this case the instance network stack.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0kitmgviu4ti579b69ho.png)

We can access the website running on the container using the Docker Host Public IP (EC2 Instance Public IP).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/047rqar83diepobq7hp4.png)   

- **none**: Blackhole, the task does not have any external network connectivity. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ho6fiuwmn7t0255hi75.png)

You shall see a message stating that the container will not have any external connectivity in the network section of the task.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hhszqw257h4wagq38g63.png)

I hope this has helped you get an idea of ECS networking. Follow me for more blogs on AWS & DevOps. 
Feel free to connect with me on [LinkedIn](https://www.linkedin.com/in/rajitpaul/)!