# Datadog on ECS: daemon agent per EC2 host, Fargate is separate
ECS has two launch types and Datadog treats them as two different setups. Picking the wrong docs page is the classic mistake.
## ECS on EC2
Run **one agent container per EC2 host** as a daemon service:
1. Create a task definition for the Datadog agent container (env: `DD_API_KEY`, `DD_SITE`, plus `DD_APM_ENABLED` / `DD_LOGS_ENABLED` if you want those).
2. Deploy it as a **daemon service** so every EC2 instance in the cluster gets one. Each agent monitors the other containers on its host.
3. Give the agent container the Docker socket mount so it can see the other containers.
The docs also cover Fleet Automation install if you would rather not hand-write the task definition.
### Reaching the agent from app containers
DogStatsD and APM traffic from your app containers goes through the host port to the agent container. Your app must use the **host private IP**, not the loopback address. Set `DD_AGENT_HOST` to the EC2 private IP (grab it from the instance metadata service) in the app container env or in tracer init. Same pattern for the trace agent endpoint.
And check security groups: do not publicly expose the APM and DogStatsD ports. They should be reachable from the tasks, not the internet.
## ECS on Fargate
Different page, different setup: the docs redirect Fargate to the Amazon ECS on AWS Fargate integration. There is no EC2 host to run a daemon on, so the agent runs as a sidecar/task in Fargate mode with its own config. Do not try to force the EC2 daemon pattern onto Fargate.
## Verify
`datadog-agent status` inside the agent container, then Infrastructure, Containers in the app filtered to the cluster. If app containers cannot reach DogStatsD/APM, exec into one and check the `DD_AGENT_HOST` value resolves to the host IP.