Microsoft has published the release of the CBL-Mariner 1.0 distribution (Common Base Linux Mariner), marked as the first stable release of the project. The CBL-Mariner distribution is being developed as a universal base platform for Linux environments used in cloud infrastructure, edge systems, and various Microsoft services. The project aims to unify the Linux solutions used in Microsoft and simplify the maintenance of various Linux systems.
The distribution provides a small standard set of core packages that serve as a universal foundation for building containers, host environments, and services run in cloud infrastructures and on edge devices. More complex and specialized solutions can be created by adding additional packages on top of CBL-Mariner, but the foundation for all such systems remains unchanged, simplifying maintenance and update preparation.
For example, CBL-Mariner is used as the basis for the mini-distribution WSLg, which provides the components of the graphical stack for running Linux GUI applications in environments based on WSL2 (Windows Subsystem for Linux). The foundation of this distribution remains unchanged, while extended functionality is achieved by including additional packages with a composite. proxy server Weston, XWayland, PulseAudio, and FreeRDP.
The CBL-Mariner build system allows for generating both individual RPM packages based on SPEC files and source texts, and monolithic system images formed using the rpm-ostree tooling, updated atomically without splitting into individual packages. Accordingly, two models of update delivery are supported: through the update of individual packages and through the rebuilding and updating of the entire system image. The distribution includes only the most essential components and is optimized for minimal memory and disk space usage, as well as fast boot times. The distribution is also notable for including various additional mechanisms for enhanced security.
The project adopts a 'maximum security by default' approach. It offers the ability to filter system calls using the seccomp mechanism, encrypt disk partitions, and verify packets through digital signatures. During the build phase, stack overflow protection modes, buffer overflow protections, and string format issue mitigations are enabled by default (_FORTIFY_SOURCE, -fstack-protector, -Wformat-security, relro). Supported address space randomization modes in the Linux kernel are activated, along with protections against attacks related to symbolic links, mmap, /dev/mem, and /dev/kmem. Read-only mode is enforced for memory areas containing kernel data segments and modules, disallowing code execution. Optionally, there’s a feature to disable kernel module loading after system initialization. The iptables toolkit is used for network packet filtering.
Готовые ISO-образы не предоставляются. Подразумевается, что пользователь может сам создать образ с необходимой начинкой (cборочные инструкции предоставлены для Ubuntu 18.04). Доступен репозиторий с уже собранными RPM-пакетами, который можно использовать для компоновки собственных образов на основе файла конфигурации. В репозитории предложено около 3300 пакетов. Например, для сборки полного iso-образа достаточно выполнить: git clone https://github.com/microsoft/CBL-Mariner.git cd CBL-Mariner/toolkit sudo make iso REBUILD_TOOLS=y REBUILD_PACKAGES=n CONFIG_FILE=./imageconfigs/full.json
The system manager systemd is used for service management and booting. RPM and DNF package managers (the tdnf variant from VMware) are provided for package management. The SSH server is not enabled by default. An installer is available for installing the distribution, which can operate in both text and graphical modes. In the installer, users can choose to install a full or basic set of packages, select a disk partition, set a hostname, and create users.
Source: opennet.ru
