Is there a way to access Docker API from the SaaS Boost application?

[kaypee90]

I want to be able to mount this volume [-v /var/run/docker.sock:/var/run/docker.sock] at the point of starting the container

[PoeppingT]

I want to be able to mount this volume [-v /var/run/docker.sock:/var/run/docker.sock] at the point of starting the container

AWS SaaS Boost containers are hosted in ECS by default, and you can find the AWS documentation describing how you would mount specific volumes to ECS containers here. This is not currently available as part of tooling for AWS SaaS Boost.

That being said, /var/run/docker.sock is the UNIX socket used by the Docker daemon to listen for Docker API requests, most of which are already covered by the AWS ECS API.

Can you explain a little more about what you're trying to accomplish?

[PoeppingT]

As of today AWS SaaS Boost will not do this automatically for you.

The only way to access the Docker API from within a Docker image is by running AWS ECS on EC2, rather than Fargate. If your container is Windows based, AWS SaaS Boost will automatically select EC2 as your compute platform as part of the ECS Task Definition (in tenant-onboarding.yaml) otherwise, AWS SaaS Boost will automatically select Fargate. To change your SaaS Boost installation to always run on EC2, you should only need to remove the if statements linked above in tenant-onboarding.yaml so that the EC2 compute platform is always selected.

This isn't enough though, as you will also need to alter the ECS Task Definition in tenant-onboarding.yaml to have a container definition with a mount point configured as in the ECS Cloudformation documentation to specify the docker.sock volume configuration. More information and details can be found in this documentation for binding mounts on AWS ECS.

[kaypee90]

@PoeppingT I updated the tenant-onboarding.yaml to always use EC2. Also I updated the Volume and MountPoints sections to mount docker.sock but I am getting this error The following resource(s) failed to create: [ECSService] trying to create a new Tenant.
Below are my updates. Am I missing anything?

ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family:
        Fn::Join: ['', ['tenant-', !Select [0, !Split ['-', !Ref TenantId]]]]
      ExecutionRoleArn: !GetAtt ECSTaskExecutionRole.Arn
      TaskRoleArn: !GetAtt ECSTaskRole.Arn
      RequiresCompatibilities:
          - EC2

MountPoints:
            !If
              - ProvisionEFS
              - - ContainerPath: !Ref MountPoint
                  SourceVolume: !GetAtt efs.Outputs.FileSystemId
                - ContainerPath: unix:///var/run/docker.sock 
                  SourceVolume: docker_sock
              - !If
                - ProvisionFsx
                - - ContainerPath: !Ref MountPoint
                    SourceVolume: !GetAtt fsx.Outputs.FSxFileSystemID
                - !Ref 'AWS::NoValue'
          LinuxParameters:
            Fn::If:
              - WindowsOS
              - !Ref 'AWS::NoValue'
              - InitProcessEnabled: true
          Secrets:
            Fn::If:
              - ProvisionRDS
              - - Name: DB_MASTER_USERNAME
                  ValueFrom: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/saas-boost/${Environment}/DB_MASTER_USERNAME
                - Name: DB_MASTER_PASSWORD
                  ValueFrom: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/saas-boost/${Environment}/DB_MASTER_PASSWORD
                - Name: DB_PORT
                  ValueFrom: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/saas-boost/${Environment}/DB_PORT
              - !Ref 'AWS::NoValue'
      Volumes:
        !If
          - ProvisionEFS
          - - Name: !GetAtt efs.Outputs.FileSystemId
              EFSVolumeConfiguration:
                FilesystemId: !GetAtt efs.Outputs.FileSystemId
            - Name: docker_sock
              Host:
                  SourcePath: unix:///var/run/docker.sock
          - !If
            - ProvisionFsx
            - - Name: !GetAtt fsx.Outputs.FSxFileSystemID
                Host:
                  SourcePath: !Sub ${FSxWindowsMountDrive}\
            - !Ref 'AWS::NoValue'

[PoeppingT]

What other error messages does CloudFormation give you? An error like The following resource(s) failed to create: [ECSService] means that you can inspect that resource (in this case ECSService) to get an error message specific to that resource, which will typically point more directly to the problem in your CloudFormation template.

[kaypee90]

@PoeppingT the earlier error I was experiencing was an issue with my YAML file, I have fixed that.
So I had to change LaunchType in the tenant-onboarding.yaml file from LaunchType: !If [WindowsOS, !Ref 'AWS::NoValue', FARGATE] to LaunchType: EC2 to get docker containers to always run on EC2.
The issue now is onboarding a Tenant gets stuck at deploying state without reporting any errors.
But on ECS events this is what I see

service tenant-7276002c was unable to place a task because no container instance met all of its requirements. Reason: No Container Instances were found in your cluster.

[PoeppingT]

Have you also altered the LaunchConfiguration for the ECSAutoScalingGroup? In ECS on EC2 you need an AutoScalingGroup with an InstanceProfile and LaunchConfiguration to actually fill any EC2 instances into your EC2 cluster if you aren't using Fargate. For more information, see this section of the tenant-onboarding.yaml template.