Running certwarden in AWS EKS/ECS?

Skeer

I know there's a dockerfile in the project.. I spent a week on trying to 'convert' that into something usable in AWS but failed miserably.
I tried searching the forums here but found practically nothing. So asking for a shove in the right direction if possible.

gregtwallace

Unfortunately, I am not at all familiar with EKS/ECS. I would assume there would be a guide somewhere for running a container there and then you could just pull the CW container like any other.

Skeer

Yeah there are, just nothing that has worked yet.. I'm also new to ECS.

Skeer

If I figure it out I'll gladly post the details here.

gregtwallace

That would be cool. Good luck!

Skeer

I have a working instance of CW in ECS. I'll lay out the steps below, some might be obvious but I'm a newb so..

create a cluster
uploaded CW image to ecr

create a task definition:

{
    "taskDefinitionArn": "arn:aws:ecs:us-east-2:12345678:task-definition/certwarden2:6",
    "containerDefinitions": [
        {
            "name": "certwarden",
            "image": "12345678.dkr.ecr.us-east-2.amazonaws.com/itops_ecr:certwarden-fixed",
            "cpu": 512,
            "memory": 4096,
            "memoryReservation": 2048,
            "portMappings": [
                {
                    "name": "http",
                    "containerPort": 80,
                    "hostPort": 80,
                    "protocol": "tcp",
                    "appProtocol": "http"
                },
                {
                    "name": "https",
                    "containerPort": 443,
                    "hostPort": 443,
                    "protocol": "tcp",
                    "appProtocol": "http"
                },
                {
                    "name": "http-01-challenge",
                    "containerPort": 4060,
                    "hostPort": 4060,
                    "protocol": "tcp"
                }
            ],
            "essential": true,
            "environment": [],
            "mountPoints": [
                {
                    "sourceVolume": "certwarden-data",
                    "containerPath": "/app/data"
                }
            ],
            "volumesFrom": [],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "/aws/ecs/itops-certwarden",
                    "awslogs-region": "us-east-2",
                    "awslogs-stream-prefix": "ecs"
                },
                "secretOptions": []
            },
            "systemControls": []
        }
    ],
    "family": "certwarden2",
    "taskRoleArn": "arn:aws:iam::12345678:role/ecsTaskExecutionRole",
    "executionRoleArn": "arn:aws:iam::12345678:role/ecsTaskExecutionRole",
    "networkMode": "awsvpc",
    "revision": 6,
    "volumes": [
        {
            "name": "certwarden-data",
            "efsVolumeConfiguration": {
                "fileSystemId": "fs-0dcad826xc3e4fg6af",
                "rootDirectory": "/"
            }
        }
    ],
    "status": "ACTIVE",
    "requiresAttributes": [
        {
            "name": "ecs.capability.execution-role-awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.ecr-auth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.21"
        },
        {
            "name": "com.amazonaws.ecs.capability.task-iam-role"
        },
        {
            "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
            "name": "ecs.capability.task-eni"
        },
        {
            "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
        },
        {
            "name": "ecs.capability.efsAuth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
        },
        {
            "name": "ecs.capability.efs"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.25"
        },
        {
            "name": "ecs.capability.extensible-ephemeral-storage"
        }
    ],
    "placementConstraints": [],
    "compatibilities": [
        "EC2",
        "FARGATE"
    ],
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "cpu": "2048",
    "memory": "6144",
    "ephemeralStorage": {
        "sizeInGiB": 21
    },
    "runtimePlatform": {
        "cpuArchitecture": "ARM64",
        "operatingSystemFamily": "LINUX"
    },
    "registeredAt": "2025-06-18T20:19:30.734Z",
    "registeredBy": "arn:aws:sts::accountID:assumed-role/AWSReservedSSO_AdministratorAccess_829dxccbndfad1b4d/user.name",
    "enableFaultInjection": false,
    "tags": []
}

create a service: I used fargate, chosen the definition created above. Set my vpc, sec groups and subnets and the first time I chose Service Discovery. Ended up having resolution issues so I created a new Service using Service Connect and created three service connect services: https, http and http-01-challenge.

Skeer

Theres obviously more bits to it, but I used defaults/stumbled my way thru to a working instance. So if I can anyone literally can set it up.

gregtwallace

Nice, thanks for the info!

Skeer

Hey Greg, How do you handle the config file in Docker?