1

I'm trying to use NTP to synchronize local time in ECS containers using the ntpdate command, but it gives me this error:

ntpdate[770]: Can't adjust the time of day: Operation not permitted

Investigating the issue, I realized that local time is managed on the host where containers are running, but in this case the container is running as an ECS Task in a Fargate cluster. So I don't know if Amazon is handling time synchronization by default for ECS containers or not, and how it works.

Is this something I do not need to worry about? Is there any AWS link explaining this?

Paul Gear
  • 3,938
  • 15
  • 36
Aramis Rodríguez Blanco
  • 11
  • 1
  • 3

1 Answers1

3

Short version: This is something you do not need to worry about.

Longer version: You couldn't do anything about it even if you wanted to, because Fargate doesn't allow privileged containers, which is what is needed to adjust the host clock.

I couldn't find any specific documentation about this, but it seems very likely that AWS uses their own NTP service for the Firecracker VMs which run Fargate containers.

Here's a test I did with ntpdate -d from an ECS container:

10 Mar 23:59:58 ntpdate[6661]: ntpdate 4.2.8p10@1.3728-o (1)
Looking for host 169.254.169.123 and service ntp
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
server 169.254.169.123, port 123
stratum 3, precision -26, leap 00, trust 000
refid [169.254.169.123], delay 0.02576, dispersion 0.00000
transmitted 4, in filter 4
reference time:    e212a876.488c7014  Tue, Mar 10 2020     23:59:50.283
originate timestamp: e212a885.19ee802f  Wed, Mar 11 2020  0:00:05.101
transmit timestamp:  e212a885.19e43c89  Wed, Mar 11 2020  0:00:05.101
filter delay:  0.02585  0.02576  0.02582  0.02579 
         0.00000  0.00000  0.00000  0.00000 
filter offset: -0.00000 -0.00004 -0.00005 -0.00003
         0.000000 0.000000 0.000000 0.000000
delay 0.02576, dispersion 0.00000
offset -0.000041

11 Mar 00:00:07 ntpdate[6661]: adjust time server 169.254.169.123 offset -0.000041 sec

As you can see, the container is 41 microseconds off from the time server, which is about right for a host synced to a very nearby time source.

Paul Gear
  • 3,938
  • 15
  • 36