Why One Team Routes Java Builds to Fargate and Docker Builds to EC2

A development team self-hosts GitLab CI runners on AWS not primarily to cut costs, but to meet a strict security requirement: build artifacts must be cryptographically signed using a KMS key accessible only to machines they control. To satisfy this, the team runs all CI workloads from a centralised AWS account using two executor types — ECS Fargate for standard Java builds and EC2 for container image builds. Fargate is preferred as the default because it requires no host maintenance and scales to zero when idle, making it cost-efficient for Maven and Gradle workflows. Docker image builds are routed to EC2 instead, since Fargate's serverless architecture lacks the native Docker daemon support and disk behaviour that container builds require. A simple tagging rule — EC2 for image builds, Fargate for everything else — was introduced to eliminate recurring confusion among developers about which runner to use.