Lachlan Donald

I implemented a workaround to do service account impersonation in https://gist.github.com/lox/8bff5607c3e713c92a03a631796ab3f3.

Where did you get up to @raff? I'd be happy to help.

No problems @YijinLiu, presumably it will eventually work!

Yeah, FWIW, we built our own that relies on this. https://github.com/99designs/aws-vault

I am having exactly the same issue, even when setting everything in `matchRequestsBy` to false.

I quite like `agent.JobSupervisor` for the current `agent.JobRunner`. Prior art from `supervisord`. I'd always imagine that we'd add "Executors" which where strategies for executing the bootstrap, what we do now...

The other option would be to do this via the API still, but reference the taskDefinition from the Cloudformation template, and then after the API update the Cloudformation to match...

Yup, I agree with all of those and intend to basically implement that @pda. I'll create an issue to track that, this PR is mostly around removing docker-compose magic.

I removed a lot of the CLI changes from scope here because they merit discussion on their own. Will just make the minimum change to remove docker-compose.

Yup, it's been on my todo list. It should be a pretty simple port.