Wondering how to resolve Amazon ECS cannotpullcontainererror? We can help you.

Here, at Bobcares, we assist our customers with several AWS queries as part of our AWS Support Services.

Today, let us see how our Support techs assist with this query.

How to resolve Amazon ECS cannotpullcontainererror?

The “cannotpullcontainererror” error can cause tasks not to start.

To start an Amazon ECS task on Fargate, your Amazon Virtual Private Cloud (Amazon VPC) networking configurations must allow your Amazon ECS infrastructure to access the repository where the image will store.

Without the correct networking, the image can’t pull by Amazon ECS on Fargate and the container can’t start.

Today, let us see the steps followed by our Support Techs to resolve it.

Confirm that your VPC networking configuration allows your Amazon ECS infrastructure to reach the image repository

The route tables associated to the subnets that your task is created in must allow your Amazon ECS infrastructure to reach the repository endpoint through an internet gateway, NAT gateway, or VPC endpoints.

If you’re not using AWS PrivateLink, complete the following steps:

1. Firstly, open the Amazon VPC console.

2. In the navigation pane, choose Subnets.

3. Then, select the subnet that your ECS Fargate task is using.

4. Next, choose the Route Table tab.

5. In the Destination column, confirm that the default route (0.0.0.0/0) of the route table enables public internet access. This access can be either through a NAT gateway or an internet gateway.

Please note that the NAT gateway or internet gateway must be the target of the default route.

If you’re using an internet gateway (public subnets), then confirm that the task has a public IP assigned to it.

To do this, launch your ECS task with Auto-assign public IP set to ENABLED in the VPC and security groups section when you create the task or service.

If you’re using PrivateLink, confirm that the security groups for your VPC endpoints allow the Fargate infrastructure to use them.

1. Firstly, open the Amazon VPC console.

2. In the navigation pane, choose Endpoints.

3. Select the endpoint from the list of endpoints, and then choose the Subnets tab.

The VPC endpoints com.amazonaws.region.ecr.dkr and com.amazonaws.region.ecr.api for Amazon ECR should be on the list of subnets and associated with the Fargate subnets.

You should also see the Amazon S3 gateway on the list of subnets.

4. Choose the Policy tab, and then confirm that the correct policy requirements are met.

5. To confirm that the security group attached to the com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr VPC endpoints allows incoming connections on port 443 from the Amazon ECS tasks for Fargate, select the endpoint from the list of endpoints.

6. Then, choose the Security Groups tab.

7. For Group ID, choose the security group ID.

8. Choose the Inbound rules tab, and then confirm that you can see the rule that allows 443 connections from your ECS tasks on Fargate.

Check the VPC DHCP Option Set

1. Firstly, open the Amazon VPC console.

2. In the navigation pane, choose Your VPCs.

3. Select the VPC that contains your Fargate task.

4. On the Details tab, note the setting for DHCP options set.

5. In the navigation pane, choose DHCP Options Sets.

6. Select the DHCP options set that you noted in step 4.

7. Choose Actions, and then choose View details.

8. Confirm that Domain name servers is set to AmazonProvidedDNS. If it isn’t set to AmazonProvidedDNS, then configure conditional DNS forwarding.

Check the task execution role permissions

1. Firstly, open the IAM console.

2. In the navigation pane, choose Roles.

3. Then, select the task execution role that your Fargate tasks are using.

4. Finally, confirm that the task execution role has the permissions to pull an image from Amazon ECR.

Check that the image exists

1. Firstly, pen the Amazon ECR console.

2. Select the Amazon ECR repository that your Fargate task should be pulling the image from.

3. Finally, confirm that the URI and the tag in Amazon ECR are the same as what’s specified in the task definition.

[Need help with the process? We’d be happy to assist]

Conclusion

In short, we saw how our Support Techs resolve Amazon ECS cannotpullcontainererror.