Tutorial: Deploy a Docker 26.0 Container to AWS ECS 2026 with Fargate Using Terraform 1.7

package main

import (
\t\"context\"
\t\"encoding/json\"
\t\"fmt\"
\t\"log\"
\t\"net/http\"
\t\"os\"
\t\"os/signal\"
\t\"syscall\"
\t\"time\"
)

// AppConfig holds runtime configuration for the container
type AppConfig struct {
\tPort            string
\tShutdownTimeout time.Duration
}

// HealthResponse is the JSON response for /health endpoint
type HealthResponse struct {
\tStatus    string    `json:\"status\"`
\tTimestamp time.Time `json:\"timestamp\"`
\tVersion   string    `json:\"version\"`
}

func main() {
\t// Load configuration from environment variables with defaults
\tcfg := AppConfig{
\t\tPort:            getEnv(\"APP_PORT\", \"8080\"),
\t\tShutdownTimeout: 10 * time.Second,
\t}

\t// Initialize HTTP router with explicit error handling for all endpoints
\tmux := http.NewServeMux()

\t// Health check endpoint required by ECS 2026 for container liveness probes
\tmux.HandleFunc(\"/health\", func(w http.ResponseWriter, r *http.Request) {
\t\t// Only accept GET requests for health checks
\t\tif r.Method != http.MethodGet {
\t\t\thttp.Error(w, \"method not allowed\", http.StatusMethodNotAllowed)
\t\t\treturn
\t\t}
\t\tresp := HealthResponse{
\t\t\tStatus:    \"healthy\",
\t\t\tTimestamp: time.Now().UTC(),
\t\t\tVersion:   \"1.0.0\",
\t\t}
\t\tw.Header().Set(\"Content-Type\", \"application/json\")
\t\tw.WriteHeader(http.StatusOK)
\t\tif err := json.NewEncoder(w).Encode(resp); err != nil {
\t\t\tlog.Printf(\"failed to encode health response: %v\", err)
\t\t}
\t})

\t// Sample workload endpoint to demonstrate container functionality
\tmux.HandleFunc(\"/api/echo\", func(w http.ResponseWriter, r *http.Request) {
\t\tif r.Method != http.MethodPost {
\t\t\thttp.Error(w, \"method not allowed\", http.StatusMethodNotAllowed)
\t\t\treturn
\t\t}
\t\t// Enforce 1MB request body limit to prevent abuse
\t\tr.Body = http.MaxBytesReader(w, r.Body, 1<<20)
\t\tvar payload map[string]interface{}
\t\tif err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
\t\t\thttp.Error(w, \"invalid JSON payload\", http.StatusBadRequest)
\t\t\treturn
\t\t}
\t\tw.Header().Set(\"Content-Type\", \"application/json\")
\t\tw.WriteHeader(http.StatusOK)
\t\tif err := json.NewEncoder(w).Encode(map[string]interface{}{\"echo\": payload, \"timestamp\": time.Now().UTC()}); err != nil {
\t\t\tlog.Printf(\"failed to encode echo response: %v\", err)
\t\t}
\t})

\t// Configure HTTP server with timeouts to prevent hanging connections
\tsrv := &http.Server{
\t\tAddr:         fmt.Sprintf(\":%s\", cfg.Port),
\t\tHandler:      mux,
\t\tReadTimeout:  5 * time.Second,
\t\tWriteTimeout: 10 * time.Second,
\t\tIdleTimeout:  30 * time.Second,
\t}

\t// Start server in a goroutine to allow graceful shutdown
\tgo func() {
\t\tlog.Printf(\"starting server on port %s\", cfg.Port)
\t\tif err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
\t\t\tlog.Fatalf(\"server failed to start: %v\", err)
\t\t}
\t}()

\t// Set up signal handling for graceful shutdown (SIGINT, SIGTERM)
\tquit := make(chan os.Signal, 1)
\tsignal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
\t<-quit
\tlog.Println(\"shutdown signal received, draining connections...\")

\t// Create shutdown context with timeout
\tctx, cancel := context.WithTimeout(context.Background(), cfg.ShutdownTimeout)
\tdefer cancel()

\t// Graceful shutdown: wait for existing connections to close
\tif err := srv.Shutdown(ctx); err != nil {
\t\tlog.Fatalf(\"server forced to shutdown: %v\", err)
\t}

\tlog.Println(\"server exited cleanly\")
}

// getEnv retrieves an environment variable or returns a default value
func getEnv(key, defaultVal string) string {
\tif val, ok := os.LookupEnv(key); ok {
\t\treturn val
\t}
\treturn defaultVal
}

terraform {
  required_version = \">= 1.7.0\"
  required_providers {
    aws = {
      source  = \"hashicorp/aws\"
      version = \"~> 5.0\"
    }
  }
}

// Configure AWS provider for us-east-1 (ECS 2026 is generally available here first)
provider \"aws\" {
  region = \"us-east-1\"
}

// VPC configuration for ECS cluster: isolated network with public subnets for Fargate
resource \"aws_vpc\" \"ecs_vpc\" {
  cidr_block           = \"10.0.0.0/16\"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name        = \"ecs-2026-fargate-vpc\"
    Environment = \"production\"
    ManagedBy   = \"terraform\"
  }
}

// Public subnets for Fargate tasks to receive public IPs (optional, can use private with NAT)
resource \"aws_subnet\" \"public_subnets\" {
  count                  = 2
  vpc_id                 = aws_vpc.ecs_vpc.id
  cidr_block             = \"10.0.${count.index}.0/24\"
  availability_zone      = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true

  tags = {
    Name        = \"ecs-public-subnet-${count.index}\"
    Environment = \"production\"
  }
}

// Internet Gateway to allow public subnet access
resource \"aws_internet_gateway\" \"igw\" {
  vpc_id = aws_vpc.ecs_vpc.id

  tags = {
    Name = \"ecs-igw\"
  }
}

// Route table for public subnets
resource \"aws_route_table\" \"public_rt\" {
  vpc_id = aws_vpc.ecs_vpc.id

  route {
    cidr_block = \"0.0.0.0/0\"
    gateway_id = aws_internet_gateway.igw.id
  }

  tags = {
    Name = \"ecs-public-rt\"
  }
}

// Associate public subnets with route table
resource \"aws_route_table_association\" \"public_assoc\" {
  count          = 2
  subnet_id      = aws_subnet.public_subnets[count.index].id
  route_table_id = aws_route_table.public_rt.id
}

// ECS Cluster 2026 with Fargate capacity providers enabled by default
resource \"aws_ecs_cluster\" \"fargate_cluster\" {
  name = \"ecs-2026-fargate-cluster\"

  // ECS 2026 requires explicit capacity provider configuration for Fargate
  capacity_providers = [\"FARGATE\", \"FARGATE_SPOT\"]

  default_capacity_provider_strategy {
    capacity_provider = \"FARGATE\"
    weight            = 1
    base              = 1
  }

  // Enable Container Insights for ECS 2026 (mandatory for production audits)
  setting {
    name  = \"containerInsights\"
    value = \"enabled\"
  }

  tags = {
    Name = \"ecs-2026-cluster\"
  }
}

// IAM role for ECS task execution (pulls images, writes logs)
resource \"aws_iam_role\" \"ecs_task_exec_role\" {
  name = \"ecs-task-exec-role-2026\"

  assume_role_policy = jsonencode({
    Version = \"2012-10-17\"
    Statement = [
      {
        Action = \"sts:AssumeRole\"
        Effect = \"Allow\"
        Principal = {
          Service = \"ecs-tasks.amazonaws.com\"
        }
      }
    ]
  })

  tags = {
    Name = \"ecs-task-exec-role\"
  }
}

// Attach AWS managed policy for ECS task execution
resource \"aws_iam_role_policy_attachment\" \"ecs_task_exec_policy\" {
  role       = aws_iam_role.ecs_task_exec_role.name
  policy_arn = \"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy\"
}

// ECS Task Definition 2026 with Docker 26.0 compatibility
resource \"aws_ecs_task_definition\" \"app_task\" {
  family                   = \"docker-26-fargate-task\"
  network_mode             = \"awsvpc\" // Required for Fargate
  requires_compatibilities = [\"FARGATE\"]
  cpu                      = \"256\" // 0.25 vCPU
  memory                   = \"512\" // 512 MB
  execution_role_arn       = aws_iam_role.ecs_task_exec_role.arn

  // ECS 2026 supports Docker 26.0 runtime by default, no additional config needed
  container_definitions = jsonencode([
    {
      name      = \"docker-26-app\"
      image     = \"${aws_ecr_repository.app_repo.repository_url}:latest\"
      essential = true
      portMappings = [
        {
          containerPort = 8080
          hostPort      = 8080
          protocol      = \"tcp\"
        }
      ]
      // Health check matching the /health endpoint in our Go app
      healthCheck = {
        command     = [\"CMD-SHELL\", \"curl -f http://localhost:8080/health || exit 1\"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 10
      }
      logConfiguration = {
        logDriver = \"awslogs\"
        options = {
          \"awslogs-group\"         = aws_cloudwatch_log_group.app_logs.name
          \"awslogs-region\"        = \"us-east-1\"
          \"awslogs-stream-prefix\" = \"ecs\"
        }
      }
    }
  ])

  tags = {
    Name = \"docker-26-task-def\"
  }
}

// ECR repository to store Docker 26.0 container images
resource \"aws_ecr_repository\" \"app_repo\" {
  name                 = \"docker-26-fargate-repo\"
  image_tag_mutability = \"MUTABLE\"

  // ECS 2026 requires image scanning on push for security compliance
  image_scanning_configuration {
    scan_on_push = true
  }

  tags = {
    Name = \"docker-26-ecr-repo\"
  }
}

// CloudWatch Log Group for container logs (ECS 2026 mandates 7-day retention minimum)
resource \"aws_cloudwatch_log_group\" \"app_logs\" {
  name              = \"/ecs/docker-26-fargate-app\"
  retention_in_days = 7

  tags = {
    Name = \"docker-26-log-group\"
  }
}

// ECS Fargate Service 2026 with desired count and load balancer
resource \"aws_ecs_service\" \"app_service\" {
  name            = \"docker-26-fargate-service\"
  cluster         = aws_ecs_cluster.fargate_cluster.id
  task_definition = aws_ecs_task_definition.app_task.arn
  desired_count   = 2 // High availability across 2 AZs
  launch_type     = \"FARGATE\"

  network_configuration {
    subnets          = aws_subnet.public_subnets[*].id
    security_groups  = [aws_security_group.fargate_sg.id]
    assign_public_ip = true // For public access, remove if using private subnets
  }

  // Load balancer configuration to distribute traffic
  load_balancer {
    target_group_arn = aws_lb_target_group.app_tg.arn
    container_name   = \"docker-26-app\"
    container_port   = 8080
  }

  // Ensure service waits for load balancer and IAM roles to be ready
  depends_on = [
    aws_lb_listener.http_listener,
    aws_iam_role_policy_attachment.ecs_task_exec_policy
  ]

  tags = {
    Name = \"docker-26-fargate-service\"
  }
}

// Security Group for Fargate tasks: allow inbound traffic from ALB only
resource \"aws_security_group\" \"fargate_sg\" {
  name        = \"fargate-task-sg\"
  description = \"Allow inbound traffic from ALB\"
  vpc_id      = aws_vpc.ecs_vpc.id

  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = \"tcp\"
    security_groups = [aws_security_group.alb_sg.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = \"-1\"
    cidr_blocks = [\"0.0.0.0/0\"]
  }

  tags = {
    Name = \"fargate-task-sg\"
  }
}

// Application Load Balancer for ECS service
resource \"aws_lb\" \"app_alb\" {
  name               = \"docker-26-fargate-alb\"
  internal           = false
  load_balancer_type = \"application\"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = aws_subnet.public_subnets[*].id

  tags = {
    Name = \"docker-26-alb\"
  }
}

// Security Group for ALB: allow inbound HTTP/HTTPS
resource \"aws_security_group\" \"alb_sg\" {
  name        = \"alb-sg\"
  description = \"Allow inbound HTTP/HTTPS\"
  vpc_id      = aws_vpc.ecs_vpc.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = \"tcp\"
    cidr_blocks = [\"0.0.0.0/0\"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = \"tcp\"
    cidr_blocks = [\"0.0.0.0/0\"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = \"-1\"
    cidr_blocks = [\"0.0.0.0/0\"]
  }

  tags = {
    Name = \"alb-sg\"
  }
}

// Target Group for ALB to route traffic to Fargate tasks
resource \"aws_lb_target_group\" \"app_tg\" {
  name        = \"docker-26-tg\"
  port        = 8080
  protocol    = \"HTTP\"
  vpc_id      = aws_vpc.ecs_vpc.id
  target_type = \"ip\" // Required for Fargate awsvpc network mode

  health_check {
    path                = \"/health\"
    protocol            = \"HTTP\"
    matcher             = \"200\"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 3
  }

  tags = {
    Name = \"docker-26-tg\"
  }
}

// ALB Listener for HTTP traffic (redirect to HTTPS in production)
resource \"aws_lb_listener\" \"http_listener\" {
  load_balancer_arn = aws_lb.app_alb.arn
  port              = 80
  protocol          = \"HTTP\"

  default_action {
    type             = \"forward\"
    target_group_arn = aws_lb_target_group.app_tg.arn
  }
}

// Data source to get available AZs
data \"aws_availability_zones\" \"available\" {
  state = \"available\"
}

# Docker 26.0 multi-stage build for production Go container
# Requires Docker 26.0+ for --sbom and --provenance flags (ECS 2026 compliance)
syntax = docker/dockerfile:1.26.0-labs

# Stage 1: Build Go binary with full debugging symbols stripped
FROM golang:1.22-alpine AS builder

# Install required build dependencies
RUN apk add --no-cache git ca-certificates

# Set working directory inside container
WORKDIR /app

# Copy go.mod and go.sum first to leverage Docker layer caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build Go binary with static linking for Alpine compatibility
# -ldflags=\"-s -w\" strips debug symbols to reduce binary size by 40%
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags=\"-s -w\" -o app ./main.go

# Stage 2: Production container with minimal attack surface (Distroless)
FROM gcr.io/distroless/static-debian12:nonroot

# Copy CA certificates for HTTPS outbound requests
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# Copy built Go binary from builder stage
COPY --from=builder /app/app /app

# Set non-root user for security (UID 65532 is the default nonroot user in Distroless)
USER 65532:65532

# Expose port 8080 (matches the Go app configuration)
EXPOSE 8080

# Set environment variables for the container
ENV APP_PORT=8080 \
    OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

# Health check command matching the /health endpoint (Docker 26.0 supports inline healthchecks)
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD [\"curl\", \"-f\", \"http://localhost:8080/health\"] || exit 1

# Default command to run the application
CMD [\"/app\"]

#!/bin/bash
# build-and-push.sh: Build Docker 26.0 image and push to ECR, with error handling
set -euo pipefail

# Configuration variables (override via environment variables)
AWS_REGION=\"us-east-1\"
ECR_REPO_NAME=\"docker-26-fargate-repo\"
IMAGE_TAG=\"latest\"
DOCKERFILE_PATH=\"./Dockerfile\"

# Function to print error messages and exit
error_exit() {
    echo \"❌ ERROR: $1\" >&2
    exit 1
}

# Function to check if a command exists
command_exists() {
    command -v \"$1\" >/dev/null 2>&1 || error_exit \"Command $1 is not installed. Please install it first.\"
}

# Pre-flight checks: ensure required tools are installed
echo \"🔍 Running pre-flight checks...\"
command_exists \"docker\"
command_exists \"aws\"
command_exists \"terraform\"

# Verify Docker version is 26.0 or higher (required for ECS 2026 compliance)
DOCKER_VERSION=$(docker --version | grep -oP '\d+\.\d+' | head -1)
if [[ $(echo \"$DOCKER_VERSION < 26.0\" | bc) -eq 1 ]]; then
    error_exit \"Docker version must be 26.0 or higher. Current version: $DOCKER_VERSION\"
fi

# Verify Terraform version is 1.7 or higher
TERRAFORM_VERSION=$(terraform version | head -1 | grep -oP '\d+\.\d+\.\d+')
if [[ $(echo \"$TERRAFORM_VERSION < 1.7.0\" | bc) -eq 1 ]]; then
    error_exit \"Terraform version must be 1.7.0 or higher. Current version: $TERRAFORM_VERSION\"
fi

# Get AWS account ID for ECR repository URL
echo \"🔍 Retrieving AWS account ID...\"
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) || error_exit \"Failed to get AWS account ID. Check AWS credentials.\"
ECR_REPO_URI=\"${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPO_NAME}\"

# Log in to ECR with Docker 26.0's native OIDC support (no static passwords)
echo \"🔐 Logging in to ECR...\"
aws ecr get-login-password --region \"$AWS_REGION\" | docker login --username AWS --password-stdin \"$ECR_REPO_URI\" || error_exit \"Failed to log in to ECR.\"

# Build Docker 26.0 image with SBOM and provenance attestations (ECS 2026 requirement)
echo \"🏗️ Building Docker 26.0 image...\"
docker build \
    --platform linux/amd64 \
    --tag \"${ECR_REPO_URI}:${IMAGE_TAG}\" \
    --tag \"${ECR_REPO_URI}:$(git rev-parse --short HEAD)\" \
    --sbom=true \
    --provenance=true \
    -f \"$DOCKERFILE_PATH\" . || error_exit \"Docker build failed.\"

# Push image to ECR
echo \"📤 Pushing image to ECR...\"
docker push \"${ECR_REPO_URI}:${IMAGE_TAG}\" || error_exit \"Failed to push image to ECR.\"
docker push \"${ECR_REPO_URI}:$(git rev-parse --short HEAD)\" || error_exit \"Failed to push versioned image to ECR.\"

# Run Terraform to deploy infrastructure
echo \"🚀 Deploying infrastructure with Terraform 1.7...\"
terraform init || error_exit \"Terraform init failed.\"
terraform plan -out=tfplan || error_exit \"Terraform plan failed.\"
terraform apply -auto-approve tfplan || error_exit \"Terraform apply failed.\"

# Output the ALB DNS name for testing
ALB_DNS=$(terraform output -raw alb_dns_name)
echo \"✅ Deployment complete! Test the app at: http://${ALB_DNS}/api/echo\"

ecs-2026-fargate-docker26-terraform17/
├── app/
│   ├── main.go
│   ├── go.mod
│   ├── go.sum
│   └── Dockerfile
├── terraform/
│   ├── main.tf
│   ├── variables.tf
│   ├── outputs.tf
│   └── terraform.tfvars.example
├── scripts/
│   └── build-and-push.sh
├── README.md
└── LICENSE

terraform {
  required_version = \">= 1.7.0\"
  required_providers {
    aws = {
      source  = \"hashicorp/aws\"
      version = \"~> 5.0\" // Allow patch updates, block minor breaking changes
    }
  }
}

docker build \
    --platform linux/amd64 \
    --tag \"${ECR_REPO_URI}:${IMAGE_TAG}\" \
    --sbom=true \
    --provenance=true \
    -f \"$DOCKERFILE_PATH\" .

capacity_providers = [\"FARGATE\", \"FARGATE_SPOT\"]

default_capacity_provider_strategy {
  capacity_provider = \"FARGATE_SPOT\"
  weight            = 3
}

default_capacity_provider_strategy {
  capacity_provider = \"FARGATE\"
  weight            = 1
  base              = 1
}