Resolve: dockertimeouterror unable transition start timeout after wait 3m0s

Wondering how to fix the error ‘dockertimeouterror unable transition start timeout after wait 3m0s’? We can help you with this!

As a part of our AWS Support Services, we often receive similar requests from our AWS customers.

Today, let’s see the steps followed by our Support Techs to help our customers to fix ‘docker timeout error unable transition start timeout after wait 3m0s’.

Dockertimeouterror unable transition start timeout after wait 3m0s

The Docker timeout error occurs when there is a networking configuration issue with the Fargate tasks. The default start timeout value for Fargate is 3 minutes. If a task doesn’t start running in 3 minutes then that task will fail and moves to the stopped state.

We must set the proper Amazon VPC endpoints if Fargate tasks are running in a private subnet with no NAT instance or gateway configured. This includes endpoints for the following:

• Amazon CloudWatch: This is required when the Fargate tasks are using awslogs as the logging driver as tasks that use awslogs as the logging driver export their logs to CloudWatch.
• The Amazon ECR: This is required for pulling the image from the ECR repository.
• Amazon S3: This is required because Amazon ECR uses Amazon S3 to store image layers.
• AWS Secrets Manager: These are required if we refer to Secrets Manager secrets Store parameters in task definitions to inject sensitive data into the containers.

Check if the task definition uses the awslogs logging driver

 
Now let’s see the steps to check if the task definition uses the awslogs logging driver:

1. Firstly, Log in to the AWS Management Console and open the Amazon ECS console.

2. Select Task Definitions.

3. Now select the task definition that’s used by our task and then select the task definition name.

4. From the Container Definitions section of the task definition, select the expander icon for the container in the Container Name column.

5. Now check if the Log driver is set to awslogs in the Log Configuration section.
 

Check and confirm that the Fargate tasks have a VPC endpoint

Now let’s see the steps to check that the Fargate tasks have a VPC endpoint:

1. Firstly, Log in to the AWS Management Console and open the Amazon VPC console.

2. Then select Endpoints and then check if com.amazonaws.region.logs exists in the Service name field.

3. If the endpoint is not there, then create a new one.

4. If it is there, then confirm if the endpoint is the same VPC where the Fargate tasks are running. For finding this, open the VPC console and then select the endpoint, and then look for the VPC ID in the Details tab of the endpoint.

5. If the endpoint isn’t used by the same VPC as the Fargate tasks, then create a new endpoint.

6. If the endpoint is used by the same VPC as the Fargate tasks, then check the security group associated with the VPC for the following:

• The ingress rule of the security group must allow traffic on port 443 from the Fargate tasks.
• The security group related to the Fargate task must have an egress rule to send traffic on port 443 to the VPC endpoint.

7. Now, the Fargate tasks can reach the CloudWatch endpoints.

[Need help with more AWS queries? We’d be happy to assist]
 

Conclusion

To conclude, today we discussed the steps followed by our Support Engineers to help our customers to resolve ‘dockertimeouterror unable transition start timeout after wait 3m0s’.