A new atomically updatable distribution of openSUSE Leap Micro 6.0 has been released

The developers of the openSUSE project have released the atomic-updatable distribution openSUSE Leap Micro 6.0, designed for microservices and as a base system for virtualization platforms and container isolation. Installable builds are available for x86_64 and ARM64 (Aarch64) architectures, as well as ready system images for virtualization systems and raw images for copying to storage devices.

The openSUSE Leap Micro distribution is based on the technologies of the MicroOS project and is positioned as a community version of the commercial product SUSE Linux Enterprise Micro, distinguished by the absence of a graphical interface. For configuration, the Cockpit web interface can be used, allowing system management through a browser, along with cloud-init for passing settings at each boot or Combustion for setting configurations during the first boot. Users are provided with tools for quickly switching from Leap Micro to SUSE SLE Micro; it is expected that one can initially deploy a solution based on Leap Micro for free, and if extended support or certification is needed, migrate the existing configuration to the SUSE SLE Micro product.

A key feature of Leap Micro is the atomic update mechanism, which automatically downloads and applies updates. Unlike atomic updates based on ostree and snap, used in Fedora and Ubuntu, openSUSE Leap Micro utilizes standard package management tools (the transactional-update utility) combined with Btrfs snapshot mechanisms (snapshots are used for atomic switching between the system state before and after installation of updates). In case of issues following the updates, the system can be rolled back to a previous state. Live patches are supported for updating the Linux kernel without rebooting and interrupting operations.

The root partition is mounted in read-only mode and does not change during operation. To launch isolated containers, an integrated toolkit with support for runtime Podman/CRI-O and Docker is included. A micro-edition of the distribution is used in the ALP (Adaptable Linux Platform) project to ensure the operation of the 'host OS' environment. In ALP, a trimmed 'host OS' is suggested for operation on the hardware, and all user space applications and components are executed not in a mixed environment but in separate containers or in virtual machines, executed over the 'host OS' and isolated from each other.

In the new release:

• The system components have been updated to the SUSE Linux Enterprise (SLE) Micro 6.0 package base, based on SUSE SLE 15 Service Pack 6.
• A system image has been created that uses full disk encryption (FDE, Full Disk Encryption) with key storage in TPMv2, requiring no passphrase input during boot. To use this image, the system must have a TPMv2 chip or run in a virtualization system emulating TPMv2.
• The assembly with the traditional installer has been discontinued, and a self-installing system image has been released (installation is performed by copying a ready image). Manual (with parameter settings) and automatic (unattended) installation modes are supported.
• Support has been added for confidential of virtual machines (CVM, Confidential Virtual Machine), the memory contents of which are encrypted using AMD SEV-SNP and Intel TDX technologies to isolate data in the virtual machine and prevent access to it by the host system.
• The SELinux mandatory access control system has been switched by default to 'enforcing' mode (in openSUSE Leap Micro, SELinux is used instead of AppArmor for enhanced container isolation).
• On x86_64 architecture systems, support for operation on systems with BIOS has been deprecated and will be removed in one of the upcoming releases.
• Support for the LTTng (Linux Trace Toolkit: next generation) toolkit has been deprecated, and bpftrace is recommended for application tracing instead.
• Support for SoC has been ensured in builds for AArch64 architecture:

  • Ampere X-Gene, eMAG, Altra, Altra Max, AmpereOne

  • AWS Graviton, Graviton2, Graviton3

  • Broadcom BCM2837/BCM2710, BCM2711

  • Fujitsu A64FX

  • Huawei Kunpeng 916, Kunpeng 920

  • Marvell ThunderX, ThunderX2; OCTEON TX; Armada 7040, Armada 8040

  • NVIDIA Grace; Tegra X1, Tegra X2, Xavier, Orin; BlueField, BlueField-2

  • NXP i.MX 8M, 8M Mini; Layerscape LS1012A, LS1027A/LS1017A, LS1028A/LS1018A, LS1043A, LS1046A, LS1088A, LS2080A/LS2040A, LS2088A, LX2160A

  • Rockchip RK3399

  • Socionext SynQuacer SC2A11

  • Xilinx Zynq UltraScale+ MPSoC

Source: opennet.ru