service

A container that runs your code and answers requests.

A service runs a container image and keeps it running. It is portable: the same declaration becomes ECS on Fargate on AWS, Cloud Run on Google Cloud and a Container App on Azure, sized from one ladder that means the same on all three.

ackee.ack

ackee 1
project "shop" {
  cloud      = "gcp"
  region     = "us-east1"
  gcpProject = "acme-shop"
}
service "api" {
  image  = "us-docker.pkg.dev/cloudrun/container/hello"
  port   = 8080
  size   = "medium"
  public = true
  env = {
    LOG_LEVEL = var.LOG_LEVEL
    REGION    = "us-east1"
  }
}

Fields

Field	Takes	Meaning
imagerequired	string \| var.NAME	The container image to run, by registry address and tag. A `var.NAME` reference is allowed, which is how one file runs a different tag in each environment.
port	whole number default 8080	The port the container listens on.
size	"small" \| "medium" \| "large" default "small"	How much CPU and memory each copy gets — see sizes. It decides what is built, so it must be written out rather than referenced.
env	map	Environment variables, as `{ NAME = "value" }`. Values may be `var.NAME` references. Connection details for anything the service is connected to are added automatically — see connect env.
build	map	Build and redeploy this service from a repository on every push — see source.
public	true \| false default true	Whether the service has an address on the internet. Set `false` for a service only other services reach. On AWS a public service gets a load balancer of its own — see below.

Any other field is refused (AK204) and the error names the exact resource type to declare with node if you need a setting the portable declaration does not offer, such as a fixed number of copies or a custom command.

Sizes

Three steps, because the useful distinction is trying something, running it, and it mattering — and because a ladder with ten rungs has rungs that mean nothing on some cloud. Each cloud's own spelling of the same step:

size	AWS (CPU units / MiB)	Google Cloud	Azure
`small`	256 / 512	1 CPU / 512Mi	0.5 CPU / 1Gi
`medium`	512 / 1024	2 CPU / 1Gi	1 CPU / 2Gi
`large`	1024 / 2048	4 CPU / 2Gi	2 CPU / 4Gi

What it becomes

A service joins the project's shared network, net, which Ackee adds once for all of a file's portable declarations and connects to each of them. You can connect your own node declarations to it by that name.

AWS

An ECS service on Fargate in the shared network, with its own security group, task role, execution role and log group. A public service — the default — also gets an Application Load Balancer of its own, forwarding to it alone, and its address is the deployment's url output. That address is plain HTTP.

For HTTPS at your own domain, set public = false and put a load balancer in front of the service with the domain and certificate — three node declarations and a traffic connection each:

ackee.ack

ackee 1
project "shop" {
  cloud  = "aws"
  region = "us-east-1"
}
service "web" {
  image = "public.ecr.aws/nginx/nginx:latest"
  port  = 80
  # Reached through the load balancer below, which carries the domain
  # and certificate, rather than through one of its own.
  public = false
}
node "lb" type "aws/alb@1" {
  name            = "public"
  healthCheckPath = "/"
}
node "site" type "aws/domain@1" {
  hostedZoneId = "Z0123456789EXAMPLE"
  recordName   = "shop.example.com"
}
node "cert" type "aws/acm-certificate@1" {
  domainName   = "shop.example.com"
  hostedZoneId = "Z0123456789EXAMPLE"
}
# `service` and `database` share a network called net; other
# declarations can join it by name.
connect network "net" -> "lb"
connect traffic "lb" -> "web"
connect traffic "lb" -> "site"
connect traffic "lb" -> "cert"

Google Cloud

A Cloud Run service with its own service account, reaching the shared network through direct VPC egress. Cloud Run gives it an HTTPS address of its own when public is true.

Azure

A Container App in the network's Container Apps environment, running as its own managed identity. Public ingress gives it an HTTPS address.