EC2实例用ECS启动容器失败，报CgroupError求助

The CgroupError: Agent could not create task's platform resources error typically stems from cgroup version compatibility issues (Ubuntu 22.04 uses cgroup v2 by default) or resource conflicts. Here are actionable fixes to resolve this:

1. Enable ECS Agent Support for Cgroup V2 #

Ubuntu 22.04 defaults to cgroup v2, which requires explicit configuration in the ECS agent:

• Check your current cgroup version:

  stat -fc %T /sys/fs/cgroup/
  

  If the output is cgroup2fs, you're using v2.
• Edit the ECS agent config file (usually /etc/ecs/ecs.config) and add:

  ECS_ENABLE_CGROUP_V2=true
  

• Restart the ECS agent to apply changes:

  sudo systemctl restart ecs
  

2. Verify EC2 Instance Resource Availability #

Insufficient memory or CPU can block task creation:

• Check available memory:

  free -h
  

  Ensure at least 256MB of free RAM is available (matching your task's memory requirement).
• Check CPU usage:

  top
  

  Confirm no process is consuming all available CPU resources.
• If the instance is under-provisioned, consider upgrading to a larger instance type (e.g., t2.small if using t2.micro).

3. Adjust Task Definition Settings #

Your current task definition has potential conflicts:

• Port Mapping Issue: When using awsvpc network mode, tasks get their own ENI, so hostPort is irrelevant and can cause conflicts if port 80 is in use on the host. Remove the hostPort field from your container definitions:

  aws ecs register-task-definition --family worker --network-mode awsvpc --requires-compatibilities "EC2" --container-definitions "[{\"name\":\"worker\",\"image\":\"xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/id89\",\"cpu\":128,\"memory\":256,\"essential\":true, \"portMappings\": [{ \"containerPort\": 80}]}]"
  

• Add Memory Reservation: Optional, but setting memoryReservation (soft limit) can help the ECS scheduler better manage resources:

  "memoryReservation": 128
  

4. Inspect ECS Agent Logs for Detailed Errors #

Get granular details about the cgroup failure by checking agent logs:

• View recent logs:

  sudo tail -n 50 /var/log/ecs/ecs-agent.log
  

• Look for lines mentioning "cgroup" or "resource creation" to pinpoint the exact issue (e.g., permission errors, missing cgroup mounts).

5. Reinstall ECS Agent as a Container (Recommended for Ubuntu) #

If you installed the ECS agent via a system package, switch to the official containerized version which handles cgroup v2 better:

docker run -d --name ecs-agent \
  --restart=always \
  --volume=/var/run/docker.sock:/var/run/docker.sock \
  --volume=/var/log/ecs/:/log \
  --volume=/var/lib/ecs/data:/data \
  --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
  --env ECS_CLUSTER=your-cluster-name \
  --env ECS_ENABLE_CGROUP_V2=true \
  --env ECS_LOGFILE=/log/ecs-agent.log \
  amazon/amazon-ecs-agent:latest

Replace your-cluster-name with your actual ECS cluster name.

内容的提问来源于stack exchange，提问作者Calibre2010