What "Serverless" Actually Means Here
Think of a traditional data center like owning a car: you buy it, maintain it, pay for insurance, and it sits in your driveway even when you're not driving. EC2 instances are similar — you provision them, patch them, and pay for them whether or not your containers are running. Fargate is more like a taxi: you pay only for the ride, and someone else handles the vehicle maintenance entirely.
AWS Fargate is a compute engine for containers that removes the need to manage the underlying EC2 instances. You define what your container needs — CPU, memory, the Docker image — and AWS handles everything below that abstraction layer: the physical server, the operating system, the container runtime, and the network plumbing.
What Fargate Removes from Your Responsibility
When you run ECS or EKS on EC2, your team owns a significant operational surface:
- Instance fleet management: Choosing instance types, managing Auto Scaling Groups, handling capacity reservations.
- OS patching: Applying security patches to Amazon Linux or Ubuntu on every worker node.
- Container runtime upgrades: Keeping the Docker daemon or containerd up to date.
- Node-level security: Hardening the host OS, managing SSH keys, monitoring for node-level intrusions.
With Fargate, none of these exist. You interact only at the Task or Pod level.
The Isolation Model
This is where Fargate's architecture diverges from shared EC2 nodes in a meaningful way. Each Fargate Task runs inside its own dedicated MicroVM — a lightweight virtual machine using technology similar to AWS Firecracker. This means:
- Container A and Container B from different customers (or even different tasks in your own account) never share kernel space.
- A kernel exploit in one task cannot affect another task.
- There is no "noisy neighbor" problem at the CPU or memory level.
On a shared EC2 node, all containers share the host kernel. If one container achieves a container escape, it has access to the host and potentially every other container on that node. Fargate's MicroVM model eliminates this attack surface entirely.
Interviewers frequently ask: "What's the security difference between running containers on EC2 vs. Fargate?" The answer is kernel isolation. On EC2, all containers on a node share the host kernel — a container escape compromises the node. On Fargate, each task runs in its own MicroVM with a dedicated kernel, so a container escape is contained to that MicroVM. Follow up by mentioning Firecracker, the open-source MicroVM technology AWS built for this purpose.
The Pay-for-What-You-Use Model
Fargate billing is per-second (with a one-minute minimum), measured from when the task starts to when it stops. If you scale to zero tasks at 2 AM, your Fargate bill for that period is exactly $0.00. On EC2, the instance continues to accrue charges regardless of whether any containers are running on it.
This model has a direct architectural implication: Fargate rewards workloads that scale dynamically. It penalizes workloads that run at constant, high utilization — because you lose the "bin packing" efficiency that EC2 provides (more on this in the Pricing concept).