ECS服务部署Docker镜像新版本后自动重启及无停机更新咨询

Hey there! Let's walk through the simplest, fully AWS-native zero-downtime pipeline solution for your ECS service—since you're looking to auto-refresh when a new latest image hits ECR. The good news is you don't need third-party tools; AWS has all the pieces built in, and we can leverage ECS's native rolling updates for zero downtime.

This is the foundational step to ensure no downtime during updates—ECS handles the heavy lifting here:

• Head to the ECS Console, find your service, and navigate to Deployment Configuration
• Set Minimum healthy percent to 100% (or higher, like 150% if you want extra redundancy during updates) and Maximum healthy percent to 200%
  • This tells ECS to launch new task instances (with your new image) first, only terminating old ones once the new instances pass health checks
• Keep the deployment controller set to ECS (the default) so ECS manages the rolling replacement automatically

With this config, your service will never drop below its desired number of healthy tasks during updates—full zero downtime.

To tie ECR image pushes to ECS service refreshes, use EventBridge + ECS API calls—no custom code needed:

• Create an EventBridge Rule for ECR Image Pushes
  • Go to the EventBridge Console, create a new rule. Select ECR as the event source, then pick the event type "Image pushed to repository"
  • Filter for your specific ECR repository and the latest image tag (so only pushes to latest trigger the update)
• Add an ECS Service Update as the Rule Target
  • Choose "AWS API Call" as the target type, then select the ECS API UpdateService
  • Fill in your ECS cluster name and service name
  • Critical: Set forceNewDeployment to true—this forces ECS to ignore the current task definition's cached image and pull the latest latest tag from ECR
  • Make sure the EventBridge execution role has the ecs:UpdateService permission (you can add this via the IAM Console with a simple policy)

Now every time you push a new latest image to ECR, EventBridge will automatically trigger an ECS service refresh, which runs as a zero-downtime rolling update.

If you're building your Docker image in AWS (e.g., with CodeBuild), CodePipeline lets you string together the entire workflow—code commit → build image → push to ECR → deploy to ECS—all with zero downtime:

• Source Stage: Connect your code repo (GitHub, CodeCommit, etc.)
• Build Stage: Use CodeBuild to build your Docker image and push it to ECR with the latest tag
• Deploy Stage: Select "Amazon ECS" as the deploy provider, specify your cluster and service. CodePipeline will automatically trigger ECS's rolling update, following your zero-downtime config

This is great if you want a fully managed CI/CD pipeline without any custom tooling.

The tool you tried had the right idea (scale out before updating), but ECS's native rolling updates already handle this logic natively. If it couldn't communicate with your service, it was likely an IAM permission issue or VPC network restriction (e.g., the tool was in a public network but your ECS cluster is in a private VPC with no public access). AWS native tools avoid these headaches since they integrate seamlessly with your AWS environment's permissions and networking.

内容的提问来源于stack exchange，提问作者Armin Orlik