awsvpc vs bridge vs host vs none

awsvpc mode gives every task its own ENI with a private IP in the VPC, enabling task-level security groups, task-level Flow Logs, and clean integration with VPC-native tooling; it's required for Fargate and is generally the recommended default on EC2 launch type too, subject to ENI-per-instance limits based on instance type. bridge mode uses Docker's own virtual bridge network on the host EC2 instance, mapping container ports to host ports — useful for legacy setups but offers only host-level (not task-level) security group granularity. host mode binds a container directly to the host's network stack with no port remapping, giving the best raw network performance at the cost of only one task per port per host instance. none mode disables networking outside the container entirely, used only for tasks with no network requirements (rare, mostly batch/offline processing).