Deploy a Production Flask App on Alibaba Cloud ECS in 30 Minutes

Local development is easy. Production deployment is where beginners get stuck. This guide takes a Flask app from python app.py to a HTTPS-served, auto-restarting production service on a single Alibaba Cloud ECS instance — the whole path, not just the happy parts.

Step 1: Pick the right server

For a small-to-medium Flask app, do not over-provision:

• 2 vCPU / 4 GB RAM is comfortable for most API workloads
• Start with a 40 GB SSD system disk; move media to object storage instead of growing the disk
• Choose the region closest to your users to minimize latency

If you are just starting and want minimal cost, a lightweight instance works fine for low traffic — you can migrate to full ECS later without re-architecting.

Step 2: System setup

sudo apt update && sudo apt upgrade -y
sudo apt install -y python3-pip nginx
python3 -m venv /opt/app/venv

Create a dedicated user for the app instead of running everything as root:

sudo useradd -m -s /bin/bash appuser
sudo chown -R appuser:appuser /opt/app

Step 3: Gunicorn + systemd

Run Flask behind gunicorn, and let systemd keep it alive:

# /etc/systemd/system/app.service
[Unit]
Description=Flask app
After=network.target

[Service]
User=appuser
WorkingDirectory=/opt/app
ExecStart=/opt/app/venv/bin/gunicorn -w 2 -b 127.0.0.1:8000 app:app
Restart=always

[Install]
WantedBy=multi-user.target

Restart=always is the line that saves you at 3 AM. Enable it with systemctl enable app.

Step 4: nginx as reverse proxy

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Step 5: HTTPS with Let's Encrypt

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d api.example.com

Certbot rewrites the nginx config and wires up auto-renewal. Test it with certbot renew --dry-run.

Step 6: The production checklist

• Environment variables for secrets — never hardcode keys
• Uvicorn/gunicorn worker count = 2 × CPU cores + 1 (roughly)
• Add a health endpoint and monitor it externally
• Set up log rotation for nginx and app logs
• Enable the security group firewall rules: only 80/443 open

That is genuinely it — a service that survives reboots, crashes, and certificate expiries, on hardware you control. For reference architectures and current cloud pricing notes I keep an independent summary at lieke-ai.com. If you are evaluating ECS pricing, the official campaign page with current offers is here: Alibaba Cloud coupons.