AWS Fargate: Serverless Containers

AWS Fargate is a serverless compute engine for containers that works with both Amazon ECS and Amazon EKS. With Fargate, you don't need to provision, configure, or scale clusters of virtual machines to run containers. You simply define your task, specify the CPU and memory requirements, and Fargate handles the rest.

---

What Makes Fargate "Serverless"?

The term "serverless" does not mean there are no servers — it means you don't manage them. With Fargate:

Traditional EC2 Approach	Fargate Approach
Choose EC2 instance types	Specify CPU and memory per task
Launch and manage EC2 instances	Fargate provisions compute automatically
Install and update the ECS agent	No agent to manage
Patch the host operating system	AWS patches the underlying infrastructure
Scale EC2 instances up and down	Tasks scale independently
Pay for EC2 instances (even if underutilised)	Pay only for the resources each task uses

---

How Fargate Works

When you launch a Fargate task, the following happens:

1. You submit a task definition specifying CPU, memory, container images, and networking
2. Fargate provisions an isolated compute environment (a lightweight microVM)
3. Your container images are pulled from the specified registry (typically ECR)
4. The containers start running inside the microVM
5. Each task gets its own elastic network interface (ENI) with a private IP address
6. When the task stops, the compute resources are released

+-------------------------------------------------------------------+
|                        AWS Fargate                                 |
|                                                                   |
|  +-------------------+  +-------------------+  +-----------------+|
|  |   MicroVM         |  |   MicroVM         |  |   MicroVM       ||
|  |  +-------------+  |  |  +-------------+  |  | +-------------+ ||
|  |  | Container A |  |  |  | Container C |  |  | | Container E | ||
|  |  +-------------+  |  |  +-------------+  |  | +-------------+ ||
|  |  +-------------+  |  |  +-------------+  |  |                 ||
|  |  | Container B |  |  |  | Container D |  |  |                 ||
|  |  +-------------+  |  |  +-------------+  |  |                 ||
|  |  [ENI: 10.0.1.5]  |  |  [ENI: 10.0.1.6]  |  | [ENI: 10.0.1.7]||
|  +-------------------+  +-------------------+  +-----------------+|
+-------------------------------------------------------------------+

Firecracker MicroVMs

Fargate uses Firecracker, an open-source microVM technology developed by AWS. Each Fargate task runs in its own Firecracker microVM, providing:

• Strong isolation — each task is isolated at the hardware virtualisation level
• Fast startup — microVMs start in less than 125 milliseconds
• Minimal overhead — microVMs use far fewer resources than traditional VMs

---

Fargate Task Sizing

With Fargate, you specify CPU and memory at the task level. The available combinations are:

CPU (vCPU)	Memory Range
0.25 vCPU	0.5 GB, 1 GB, 2 GB
0.5 vCPU	1 GB – 4 GB (in 1 GB increments)
1 vCPU	2 GB – 8 GB (in 1 GB increments)
2 vCPU	4 GB – 16 GB (in 1 GB increments)
4 vCPU	8 GB – 30 GB (in 1 GB increments)
8 vCPU	16 GB – 60 GB (in 4 GB increments)
16 vCPU	32 GB – 120 GB (in 8 GB increments)

Right-Sizing Your Tasks

Choosing the right size is important for both performance and cost:

• Start small and monitor CPU and memory utilisation in CloudWatch
• Scale up if you see consistent high utilisation or task failures due to out-of-memory errors
• Scale down if utilisation is consistently low
• Container-level resource limits allow you to share the task's resources among multiple containers

---

Fargate Networking

Every Fargate task gets its own Elastic Network Interface (ENI) with:

• A private IPv4 address from your VPC subnet
• An optional public IPv4 address (if assignPublicIp is ENABLED)
• Full support for security groups

Common Network Configurations

Scenario	Configuration
Public-facing web app	Task in public subnet, public IP enabled, ALB in front
Internal API	Task in private subnet, no public IP, accessed via ALB or service discovery
Task needs internet access	Task in private subnet, NAT Gateway in public subnet
Fully isolated	Task in private subnet, VPC endpoints for AWS services

VPC Endpoints for Fargate