ECS CDK: fluentd-async-connect is deprecated since Docker 20.04

[michaelxuao]

Describe the bug

moby/moby#46114

fluentd-async should be used instead as it has existed since docker 20.04

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Docker launches the ECS container as expected.

Current Behavior

Deprecated setting has been removed in Docker v28 and now containers relying on Fluentd Log Driver will crash

level=error time=[REDACTED] msg="Error transitioning container" error="Error response from daemon: unknown log opt 'fluentd-async-connect' for fluentd log driver" task="[REDACTED]" container="[REDACTED]" runtimeID="" nextState="CREATED"

https://docs.docker.com/engine/release-notes/28/

Reproduction Steps

Install docker-ce-28 and try to run ECS container with fluentd driver.

Possible Solution

default config to use fluentd-async with fluentd-async-connect left as a legacy option

Additional Information/Context

No response

CDK CLI Version

2.136.0

Framework Version

No response

Node.js Version

20

OS

MacOS

Language

TypeScript

Language Version

No response

Other information

No response

[michaelxuao]

aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/log-drivers/fluentd-log-driver.ts

Line 81 in 994e952

'fluentd-async-connect': this.props.asyncConnect,

[pahud]

Reproduction

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import { Construct } from 'constructs';

export class Issue34055ReproStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Create a VPC
    const vpc = new ec2.Vpc(this, 'ReproVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create an ECS Cluster
    const cluster = new ecs.Cluster(this, 'ReproCluster', {
      vpc: vpc,
    });

    // Add EC2 capacity to the cluster
    cluster.addCapacity('DefaultAutoScalingGroupCapacity', {
      instanceType: new ec2.InstanceType('t3.micro'), // Or another suitable instance type
      desiredCapacity: 1, // Start with one instance
    });

    // Define an EC2 Task Definition
    const taskDefinition = new ecs.Ec2TaskDefinition(this, 'ReproTaskDef', {
      // networkMode: ecs.NetworkMode.AWS_VPC, // Optional: Use awsvpc network mode if needed
    });

    // Add a container using the Fluentd log driver
    taskDefinition.addContainer('NginxContainer', {
      image: ecs.ContainerImage.fromRegistry('nginx:latest'),
      memoryLimitMiB: 256, // Define memory limits at the container level for EC2
      cpu: 128, // Define CPU limits at the container level for EC2
      portMappings: [{ containerPort: 80 }],
      logging: ecs.LogDrivers.fluentd({
        // Using fluentd driver triggers the deprecated 'fluentd-async-connect' option
        address: 'tcp://127.0.0.1:24224', // Dummy address for demonstration
        tag: 'nginx.access',
        asyncConnect: true, // Explicitly set to true to ensure the option is included
        // Note: The 'asyncConnect' property defaults to true, which maps to 'fluentd-async-connect'
      }),
    });

    // Output the Task Definition ARN
    new cdk.CfnOutput(this, 'TaskDefinitionArn', {
      value: taskDefinition.taskDefinitionArn,
    });
  }
}

cdk synth

ReproTaskDefD3A03199:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Cpu: 128
          Essential: true
          Image: nginx:latest
          LogConfiguration:
            LogDriver: fluentd
            Options:
              fluentd-address: tcp://127.0.0.1:24224
              fluentd-async-connect: "true"  # <-- Deprecated option is present
              tag: nginx.access
          Memory: 256
          Name: NginxContainer
          PortMappings:
            - ContainerPort: 80
              HostPort: 0
              Protocol: tcp
      Family: Issue34055ReproStackReproTaskDef306C905A
      NetworkMode: bridge # Default for EC2 Task Definition
      RequiresCompatibilities:
        - EC2
      TaskRoleArn:
        Fn::GetAtt:
          - ReproTaskDefTaskRole8E729A72
          - Arn
    Metadata:
      aws:cdk:path: Issue34055ReproStack/ReproTaskDef/Resource

Workaround

      // Workaround: Use GenericLogDriver class to avoid the deprecated 'fluentd-async-connect' option
      logging: new ecs.GenericLogDriver({
        logDriver: 'fluentd',
        options: {
          'fluentd-address': 'tcp://127.0.0.1:24224', // Dummy address
          'tag': 'nginx.access',
          // 'fluentd-async-connect' is intentionally omitted here
          // Add other desired fluentd options here if needed, e.g.:
          // 'fluentd-buffer-limit': '128',
          // 'fluentd-retry-wait': '1s',
          // 'fluentd-max-retries': '10',
        },
      }),

This should synth to

LogConfiguration:
  LogDriver: fluentd
  Options:
    fluentd-address: tcp://127.0.0.1:24224
    tag: nginx.access

Reproducible. While workaround is available, we still have to update this deprecated behavior. Making this a p1.

Reference

https://docs.docker.com/engine/deprecated/
https://docs.docker.com/engine/release-notes/20.10/
https://docs.docker.com/engine/release-notes/28/

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.