保留正文与补采附件。源页面当前未重新核验；具体限制见交付清单。

Revisit consent button We value your privacy We use cookies to enhance your browsing experience, serve personalised ads or content, and analyse our traffic. By clicking "Accept All", you consent to our use of cookies. Customise Reject All Accept All Customise Consent Preferences We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below. The cookies that are categorised as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... Show more NecessaryAlways Active Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

Functional Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

Analytics Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

Performance Performance cookies are used to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for the visitors.

Advertisement Advertisement cookies are used to provide visitors with customised advertisements based on the pages you visited previously and to analyse the effectiveness of the ad campaigns.

Uncategorised Other uncategorised cookies are those that are being analysed and have not been classified into a category as yet. No cookies to display. Reject All Save My Preferences Accept All Toggle SearchToggle Mobile Navigation Publish AI, ML & data-science insights to a global community of data professionals. Sign inSubmit an Article LatestEditor's PicksNewsletterShipAI

Write For TDS LinkedInXToggle Search Data Engineering

I Deployed My Data Pipeline to AWS. Then Everything That Was “Local” Broke.

What moving a Dockerized pipeline off my laptop taught me about containers, networking, and hidden assumptions. Ibrahim Salami August 25, 202612 min read Generated with Gemini AI For the past few months, I've been building a small data pipeline entirely on my Windows machine. RSS ingestion running in WSL2, Postgres in Docker, Kestra orchestrating the whole thing, dbt transforming the data on top. Every piece worked. I had a working lineage graph, passing tests, a scheduled flow that fetched articles and saved them to a database. It all worked because it was all sitting in one place. My laptop. This article is about what happened when I tried to move it off my laptop and onto a real server, using nothing but the CLI. I expected the hard part to be AWS itself: accounts, instances, networking. It wasn't. The hard part was everything I didn't know I'd built on top of "it's all running on the same machine." That assumption was doing more work than I realized, and taking it away broke things one at a time, in ways that taught me more than the original build did.

Setting up the box

Getting a server running was, honestly, the easy part. Learn this step by step with the interactive Data Engineer roadmap.

I created an AWS account on the newer $100-credit free tier, set up an IAM user for CLI work instead of using root (a small good habit that saved me from myself more than once), and launched a t3.small EC2 instance running Ubuntu 22.04. A few small surprises came up along the way. Nothing major, but enough to remind me that a cloud server isn't just my computer in a different location. The default 8GB disk was too small before I'd even started. Resizing it meant running growpart and resize2fs, and the instructions I found online kept referencing a device called xvda. My instance didn't have one. Newer instance types use the Nitro system, which names drives things like nvme0n1 instead. Small naming difference, but it's the kind of thing that makes you doubt everything else you're about to type, since if the first command doesn't even find its target, what else is going to quietly not apply. I also saw the instance go “impaired” at one point while Kestra was pulling its Docker image for the first time. My best guess was that it had run out of memory. I added a 1GB swap file as a bit of extra breathing room, and it hasn’t happened since. Basically, it gives the system somewhere to offload memory when the RAM gets full, using disk space as a slower backup. It was a simple fix, but it was also my first reminder that a rented server doesn’t have quite the same headroom I’d gotten used to on my laptop. I attached an Elastic IP so the server's address wouldn't change every time I stopped and started it, and locked down the security group so only my own IP could reach ports 22 (SSH), 8080 (Kestra's UI), and 5432 (Postgres). That last part turned into its own minor recurring chore: my home internet doesn't give me a fixed IP address, so most sessions started with me re-authorizing whatever address I currently had before anything else would even load. None of this was hard. It was just a lot of small, specific facts about this particular kind of computer that nothing in my local setup had ever forced me to learn.

Getting the pipeline over

I installed Docker, brought over my project with rsync instead of git, since my repo is public and my .env file has real secrets in it, and ran docker compose up -d. Postgres came up healthy. Kestra came up too. One thing caught me off guard here: Kestra's flows don't live in files that sync automatically when you copy a project over. They live inside Kestra's own internal database. My one flow, fetch_rss, simply didn't exist on the server until I pasted its YAML into the UI myself. It's a small thing, but it's the first hint of a pattern that showed up again and again during this whole process: things that felt like "my project" were actually split across two different kinds of state, files I own and copy around, and internal state that lives only inside the running system. I clicked Execute. It failed immediately.

The toolbox that wasn't there

My flow used a Process task runner for the actual work. It built the Python virtual environment, installed the dependencies, and ran my ETL script. That was exactly how I had it set up locally, and it had never caused me any problems. The error was about a missing package: python3.12-venv. Digging in, I learned something I genuinely hadn't considered. The Process task runner doesn't run on the EC2 host. It runs inside Kestra's own container. Kestra's container had Python, but not the piece needed to build a virtual environment. I fixed it temporarily by running apt-get install -y python3.12-venv directly inside the container. It worked, but I knew it wouldn’t survive a restart because the change wasn’t part of the image itself. I’d fixed the immediate problem, but not the underlying setup. This is where I had to make a real decision, and it's the first genuinely useful lesson from this whole project: the manager and the worker shouldn't be the same thing. Kestra's job is to decide when things run and keep track of them. It is not supposed to also be the thing building Python environments and installing packages by hand. Every time a task needed something new, I'd be rebuilding Kestra's own image to fit, which is a strange amount of responsibility to hand to your orchestrator. Instead of trying to keep patching Kestra itself, I moved the actual work out of it and switched the task to Kestra’s Docker task runner. The idea was pretty simple: Kestra would spin up a separate container just for the Python job, run the ETL script there, and get rid of the container when the job was done. It was closer to how I wanted the setup to work, although I was about to run into a few more complications.

Giving the manager a key it didn't know it needed

For Kestra to launch a separate worker container, it needs to be able to talk to Docker itself, the actual daemon managing containers on the host. The way you grant that is by mounting the Docker socket into Kestra's own container: yaml

kestra:
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock

This is worth sitting with for a second, because it's not a neutral decision. Anything with access to that socket can effectively ask Docker to do anything on the host, including spinning up containers with far more access than they should have. Locally, on my own laptop, this never registered as a real tradeoff. On a machine sitting on the open internet, it's a genuine one. I decided it was acceptable for a learning project running a single low-stakes flow, but it's exactly the kind of decision that deserves to be made on purpose, not discovered by accident three steps into a debugging session. With the socket mounted, I updated the flow to use the Docker task runner and pointed it at a python:3.12-slim image. First real test: Permission denied. Turned out the socket being mounted wasn't enough. Kestra's own process inside the container wasn't running as root, and that particular door only opens for root. Having the key isn't the same as being allowed to use it. Adding user: "0:0" to Kestra's service definition fixed it, though not before I spent a confusing round-trip discovering that Docker Compose doesn't always rebuild a container just because you changed a line in the file. docker compose up -d --force-recreate kestra was the command that actually made the change take effect. up -d alone quietly decided nothing important had changed.

The volume that wasn't really there

With permissions sorted, the flow ran further, and hit a new wall: Could not open requirements file: No such file or directory. I'd mounted my project folder into the worker container so it could see the script and its dependencies. I could prove the mount worked by running the exact same docker run command by hand, outside of Kestra, and it worked perfectly. Whatever Kestra was doing, it wasn't the same thing. This ended up being the longest detour in the whole project, and honestly, probably the one that annoyed me the most in hindsight. The worst part was how quietly it failed. I first tried a setting called volume-enabled, but I had it in the wrong part of the config. Then I tried again with the correct property name, volumeEnabled—no dash—and put it in the right place, under plugins.configurations, targeting the Docker task runner plugin by its full class name. Still nothing. No error. No warning. Nothing. It just kept silently ignoring the setting. Eventually, I found the real explanation: host-folder mounting for the Docker task runner appears to require Kestra’s Enterprise edition. I’d been chasing a setting that simply doesn’t work on the free tier I’m using. It wasn’t a typo or a misconfiguration. I was basically trying to open a door that I didn’t even know was locked. The frustrating part was that Kestra never made that clear—it just quietly ignored the setting and left me wondering what I was doing wrong.

I want to flag this specifically for anyone following a similar path: when a setting appears to do nothing no matter how correctly you write it, stop assuming you have the syntax wrong. Check whether the feature exists in the edition you're actually running.

The way that's actually meant to work

The fix wasn't to force the mount to work. It was to stop trying to mount anything at all. Kestra has a feature called Namespace Files, essentially a small file store that lives inside Kestra itself. You upload your project's files into it once, and Kestra hands them to worker containers automatically at runtime, no host folder access required. It's the fully-supported version of what I was trying to hack together with volumes. Uploading them from the server turned into its own small chain of mistakes, which by this point in the day felt almost expected. I tried a PUT request first; Kestra wanted a POST with the file wrapped as multipart form data. I got that right and got back silence, no confirmation, no error, which I initially read as success. It wasn't. A curl -i flag to actually show me the response headers revealed the real problem: 401 Unauthorized. Basic auth had been on the whole time, my browser just never told me because it was already logged in. curl has no memory like that. Adding -u username:password to every request fixed it. Once the files were uploading, I made a habit of checking each one immediately after, since one early batch attempt had somehow paired the wrong file sizes with the wrong filenames. Slower, but it meant every mismatch got caught the moment it happened instead of surfacing three steps later as a mysterious script error. With all six files confirmed correct, I rewrote the flow to use namespaceFiles: enabled: true instead of a volume mount, and switched the file paths from absolute (/workspace/python/...) to relative (python/...), since Namespace Files land directly in the container's working directory rather than wherever I'd been mounting things. This time, it actually ran the script. Fetched 25 articles. Parsed them. And then: text

psycopg.OperationalError: connection failed: connection to server at "127.0.0.1", port 5432 failed: Connection refused

The last assumption: localhost isn't a place

This was the smallest fix of the whole day, and also the most honest one, in the sense that it exposed an assumption I'd never had reason to question before. My database config had DB_HOST=localhost by default. And locally, that was perfectly fine. Everything was running on the same machine, so saying “the database is right here” was actually true. But on AWS, Kestra’s worker was running in its own separate container. So when it tried to connect to localhost, it was basically looking inside its own little container and saying, “Where’s the database?” Postgres was sitting in a different container, one that it could reach through the shared Docker network using the service name postgres instead. I passed the real connection details into the worker container as environment variables, matching them against the container network we'd set up earlier (networkMode: rss-pipeline_default, the same network Postgres and Kestra already shared), and the pipeline finally ran start to finish. Fetched articles, saved them, done. The very last thing I fixed, immediately after, was the password sitting in plain text in that same config. Kestra has a KV store built for exactly this, a place to store a value once and reference it from the flow ({{ kv('DB_PASSWORD') }}) instead of writing it out anywhere. Small thing, but it felt like the right note to end on: getting something working and then immediately asking whether the way it's working is one I'd be comfortable with someone else seeing.

What actually broke, and why it matters

Zooming out, every single failure in this process traced back to one of two things:

Things That Worked Locally but Broke Across Containers

“The database is on localhost”, “The Python environment I set up by hand is still here.”. Locally, being on the same machine does a lot of invisible work for you. You don’t think of those things as requirements because you never had to. They’re just there, and everything works. Once you move to separate containers, those assumptions disappear, and suddenly you realize how much you were relying on them without even noticing.

Things That Failed Silently Instead of Loudly.

A mistyped config property. A feature that doesn't exist in the tier you're running. An unauthenticated request that returns nothing instead of an error. None of these crashed anything. They just quietly did less than I asked, which is a much harder thing to debug than an actual crash, because there's no stack trace pointing at the gap. You just have to notice that something didn't happen. If I had to compress this into one piece of advice for someone doing this for the first time: when something you built locally moves to a real server, treat every assumption about "things being in the same place" as a claim you need to re-prove, not a fact you get to keep. And when a fix seems to do nothing at all, however many times you double check the syntax, consider that it might genuinely be doing nothing, because the feature isn't available to you in the first place.

What's Next

The pipeline itself is done, running, and actually saving real data to a cloud database. That was the goal for this piece, and it's genuinely satisfying to type that sentence after the day I just had. I've been going back and forth on what comes after this. Part of me wants to finish the full loop, connect rss-transform, my dbt project, to this new cloud database, and close out the RSS pipeline as one complete, end-to-end story from raw feed to clean, tested data. There's something appealing about that kind of closure. But if I'm honest, this project has already taught me most of what it set out to teach me. I went from "what even is a Docker container" to debugging Docker socket permissions, silent config failures, and container networking, on a real server, with real consequences when I got something wrong. That was the whole point of picking this project in the first place, and at some point, squeezing more lessons out of the same pipeline starts to feel like staying somewhere past when I've actually outgrown it. So I'm genuinely undecided, and I think that's an honest place to leave this piece. Maybe the next article is the dbt-to-cloud connection, wrapping this series up properly. Maybe it's something completely new, a fresh project, a different set of skills, a reason to feel like a beginner again in a new way. I don't know yet, and I'd rather say that plainly than manufacture a tidy roadmap I'm not actually committed to. Either way, I'll be documenting it the same way I documented this: honestly, mistakes included. This is part of my ongoing series documenting my transition from systems analyst to data engineer. If you’ve been following along, thank you. Connect with me on LinkedIn ,YouTube , and Twitter .

Register Now to Continue Reading

Unlock Towards Data Science with a Free Account

All articles on Towards Data Science are available to registered users. Create a free account today to access this article and thousands more. Register for freeSign in to your account

Written By

Ibrahim Salami

See all from Ibrahim Salami AWSData PipelineData ScienceDockerProgramming Share This Article

Towards Data Science is a community publication. Submit your insights to reach our global audience and earn through the TDS Author Payment Program. Write for TDS

Related Articles

Create Your Custom, private Python Package That You Can PIP Install From Your Git Repository

Programming Share your self-built Python package using your git repo. Mike Huls July 3, 20216 min read

An Intuitive Guide to LSTMs

Machine Learning by creating them from scratch Victor Sim September 27, 20207 min read

Stratified Sampling: You May Have Been Splitting Your Dataset All Wrong

Deep Learning Randomly generating splits of the data set is not always the optimal solution, as the proportions in the target variable can be extremely... Angel Igareta July 21, 20213 min read

3 Bitter Lessons I Wish I Knew Earlier As a Big Data Engineer

Data Science The Dos and Don'ts of data engineering Nam Nguyen August 6, 20216 min read

5 R Objects You Should Learn to Master R Programming

Machine Learning R is a really flexible language - here, we are going to learn the objects that will power up your R Data Analytics and Science scripts Ivo Bernardo October 29, 20216 min read

Introducing Server-Sent Events in Python

Programming A simpler path to coding real-time web applications Thomas Reid August 4, 202512 min read

Make a mock "real-time" stream of data with Python and Kafka

Machine Learning Everything you need to turn a .csv file of timestamped data into a Kafka stream with Python and Docker Maria Patterson August 29, 20215 min read

Latest picks: Meta-Policy Gradients: A Survey

Machine Learning Your daily dose of data science TDS Editors January 4, 20211 min read

From ‘Dataslows’ to Dataflows: The Gen2 Performance Revolution in Microsoft Fabric

Data Engineering How the latest Dataflow enhancements change the way we play the game Nikola Ilic January 13, 20268 min read

Your home for data science and AI. The world's leading publication for data science, data analytics, data engineering, machine learning, and artificial intelligence professionals. Subscribe to Our NewsletterWrite For TDS•About•Advertise•Privacy Policy•Terms of Use © Insight Media Group, LLC 2026•The New Stack•roadmap.sh•Creator Network

Recommended Articles

Close