We're having an issue using AWSX where we're trying to manage a fargate service, and on every

pulumi up

it thinks we need to delete/re-create the container defn. Here is one of the diff outputs (edited). We compared the diffs across different successful runs of

pulumi up

and they are always the same.

[id=pganalyze-fargate]
    [urn=urn:pulumi:production::rainbow-infra::awsx:x:ecs:FargateTaskDefinition$aws:ecs/taskDefinition:TaskDefinition::production-pganalyze-service]
    __defaults             : []
    containerDefinitions   : "[{"image":"<http://quay.io/pganalyze/collector:stable|quay.io/pganalyze/collector:stable>","cpu":256,"memory":512,"essential":true,"ulimits":[{"name":"nofile","softLimit":32000,"hardLimit":65536}],"environment":[{"name":"DB_HOST","value":"snip},{"name":"DB_USERNAME","value":"pganalyze"},{"name":"DB_NAME","value":"rainbow"}],"secrets":[{"name":"PGA_API_KEY","valueFrom":"snip"},{"name":"DB_PASSWORD","valueFrom":"snip"}],"logConfiguration":{"logDriver":"awsfirelens"},"readonlyRootFilesystem":false,"mountPoints":[],"name":"pganalyze"},{"cpu":128,"memory":512,"image":"<http://XXX.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-for-fluent-bit:2.26.0|XXX.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-for-fluent-bit:2.26.0>","firelensConfiguration":{"type":"fluentbit","options":{"config-file-type":"file","config-file-value":"/log_destinations.conf"}},"environment":[{"name":"SERVICE_NAME","value":"pganalyze"},{"name":"SERVICE_ENV","value":"production"},{"name":"GRAFANA_USER","value":"XXX"},{"name":"GRAFANA_API_KEY","value":"[secret]"}],"essential":true,"logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"/ecs/ecs-aws-fluentbit-sidecar-logger","awslogs-region":"us-west-2","awslogs-stream-prefix":"pganalyze","awslogs-create-group":"True"}},"name":"logs"}]"
    cpu                    : "512"
    executionRoleArn       : "arn:aws:iam::XXX:role/rainbow-pganalyze-role-2961ff0"
    family                 : "pganalyze-fargate"
    memory                 : "1024"
    networkMode            : "awsvpc"
    requiresCompatibilities: [
        [0]: "FARGATE"
    ]
    taskRoleArn            : "arn:aws:iam::XXX:role/rainbow-pganalyze-task-role-919c4b6"%

Any ideas? What are we doing wrong?