Difference between Docker and AMI

Question

In the context of AWS:

AMI is used to package software and can be deployed on EC2. Docker can also be used to package software and can also be deployed to EC2.

What's the difference between both and how do I choose between them?

Solution 1

An AMI is an image. This is a whole machine that you can start new instances from. A docker container is more lightweight and portable. A docker container should be transportable between providers while an AMI is not (easily).

AMI's are VM images basically. Docker containers are packaged mini-images that run on some VM in an isolated environment.

Solution 2

Eventhough this doesn't answer the question directly, but gives some background on how they are used.

One approach is you launch EC2 instances with Amazon AMI's (or can be any AMI) then run docker containers (with all dependencies) on top of it. With this approach, the docker image gets bloated over time and there is a container drift over time. Also time taken for the application to be up and running is more as the Ec2 has to be booted and docker has to bring up your app server.

Another approach is "Immutable Ec2 instances". With this approach, you use Amazon AMI as base and install all the dependencies ( use shell scripts or Ansible) and bake them in the AMI. We use Hashicorp Packer which is an amazing tool. Here the time taken for the application to be up and running is greatly reduced as all the dependencies ( java8 , tomcat, war file etc) are already installed in the AMI.

For production use case, use Packer to create AMI and use Terraform to launch cloud resources to use this AMI. Tie all this together in Jenkins pipeline.

Solution 3

This link has details about differences between Docker and AMI:- https://forums.docker.com/t/how-would-you-differentiate-between-docker-vs-ec2-image/1235/2

Comments

[mariotti]

Technically speaking you cannot deploy a docker image/container on EC2 without an AMI. Or better an EC2 instance exists only if you provide an AMI first. Docker will run on this: EC2/AMI.

[Dror]

Shouldn't the comparison be between AMI and docker images?

[mariotti]

I agree with @Dror, but more over (within AWS) you cannot have any docker form without having an AMI first! Somehow the docker is "transportable" if and only if the AMI allows it ;) There is also an other little issue. The "hardware" is defined by the AMI and not by the docker container/image. Oops.. not even, the hardware is defined typically by the EC2 or fargate, but they both need an AMI.

[mariotti]

An additional issue is security. This opens a lot more alternative questions and it depends highly on your setup. But the trend I have seen today is that docker images typically have NO security builtin. While AMI can have, should have, a minimum security builtin. On AWS you do have additional tools to secure your system, but for example an EC2 with a given AMI running a docker image might rely heavily on the AMI security. Like SSL/SSH versions.

[Martin Grey]

Although your answer is 100% correct, it might also become 100% useless if the link target disappears. Please, edit your answer and leave the link as the original source.