The release of the Linux distribution Bottlerocket 1.3.0 has been announced, developed with the participation of Amazon for efficient and secure microservices deployment. The tools and control components of the distribution are written in Rust and distributed under the MIT and Apache 2.0 licenses. Bottlerocket can run in Amazon ECS clusters, VMware, and AWS EKS Kubernetes, and supports the creation of custom builds and editions that allow the use of various orchestration tools and runtimes for containers.
The distribution provides an atomically and automatically updatable immutable system image, which includes the Linux kernel and a minimal system environment, containing only the components necessary to run containers. The environment employs the system manager systemd, the Glibc library, the Buildroot build toolchain, the GRUB bootloader, the wicked network configurator, the runtime for isolated containers containerd, the Kubernetes container orchestration platform, the aws-iam-authenticator authenticator, and the Amazon ECS agent.
Container orchestration tools are provided in a separate management container, which is included by default and managed via the API and AWS SSM Agent. The base image does not include a command shell, server SSH and interpreted languages (such as Python or Perl) are not included; administrator tools and debugging are offloaded to a separate service container, which is disabled by default.
The key difference from similar distributions, such as Fedora CoreOS and CentOS/Red Hat Atomic Host, is the primary focus on providing maximum security in the context of enhancing system protection against potential threats, complicating the exploitation of vulnerabilities in OS components, and increasing container isolation. Containers are created using native Linux kernel mechanisms: cgroups, namespaces, and seccomp. For additional isolation, SELinux is used in 'enforcing' mode.
The root partition is mounted in read-only mode, while the configuration partition /etc is mounted in tmpfs and resets to its original state after a reboot. Direct modification of files in the /etc directory, such as /etc/resolv.conf and /etc/containerd/config.toml, is not supported; use the API for permanent settings storage or externalize functionality in separate containers. The dm-verity module is used for cryptographic verification of the root partition's integrity, and in case of any modification attempts at the block device level, the system reboots.
Most system components are written in Rust, which provides tools for safe memory handling, helping to avoid vulnerabilities caused by accessing freed memory, dereferencing null pointers, and buffer overflows. The default build modes include "--enable-default-pie" and "--enable-default-ssp" to enable Position Independent Executable (PIE) address space randomization and stack overflow protection through canary substitutions. For packages written in C/C++, additional flags "-Wall", "-Werror=format-security", "-Wp,-D_FORTIFY_SOURCE=2", "-Wp,-D_GLIBCXX_ASSERTIONS", and "-fstack-clash-protection" are also enabled.
In the new release:
- Vulnerabilities in the docker toolkit and runtime containerd (CVE-2021-41089, CVE-2021-41091, CVE-2021-41092, CVE-2021-41103) related to incorrect permission settings have been eliminated, allowing unprivileged users to escape the base directory and execute external programs.
- Support for kubelet and pluto has been added. support for IPv6.
- The ability to restart the container after changing its settings has been provided.
- Support for Amazon EC2 M6i instances has been added to the eni-max-pods package.
- Support for device filters has been added to open-vm-tools, implemented using the Cilium toolkit.
- A hybrid boot mode has been implemented for the x86_64 platform (with EFI and BIOS support).
- Package versions and dependencies for the Rust language have been updated.
- Support for the aws-k8s-1.17 distribution variant based on Kubernetes 1.17 has been discontinued. It is recommended to use the aws-k8s-1.21 variant with support for Kubernetes 1.21. In the k8s variants, settings for cgroup runtime.slice and system.slice are in effect.
Source: opennet.ru
