Microsoft has released the first stable update of the new branch of the Azure Linux 3.0 distribution, which was previously known as CBL-Mariner. The distribution is being developed as a universal base platform for Linux environments used in cloud infrastructure, edge systems, and various Microsoft services. The project aims to unify the Linux solutions used at Microsoft and simplify the maintenance of Linux systems for various purposes. The project's developments are licensed under MIT. Package builds are created for aarch64 and x86_64 architectures. The size of the installation image is 740 MB.
Among the changes in the new version:
- The Linux kernel has been updated to version 6.6 (previously it used kernel 5.15). Support for live patching has been added, allowing vulnerabilities in the kernel to be addressed without a reboot.
- New versions of packages have been proposed, including systemd 255, glibc 2.38, GCC 13.2, clang 18.1, OpenSSL 3.3, rpm 4.18.2, ruby 3.3.0, BIND 9.20, containerd 1.7.13, kunc 1.1.12, ostree 2024.5, rust 1.75, Perl 5.38, Python 3.12.3, QEMU 8.2.0.
- The SELinux mandatory access control system is now set to 'enforcing' mode by default.
- The unified cgroups v2 hierarchy is enabled by default. The key difference between cgroups v2 and v1 is the use of a single cgroup hierarchy for all types of resources, rather than separate hierarchies for CPU resource allocation, managing memory consumption, and I/O.
- Tools have been added for replacing other distributions (OSsku In-Place Migration) on nodes in Microsoft Azure cloud, for example, it is now possible to replace an installed Ubuntu with Azure Linux.
- Support for new NVIDIA GPUs has been added, such as the NVIDIA A100 and H100, along with the provision of the NVIDIA GPU Operator for automating driver management on nodes running Azure Linux.
The Azure Linux distribution provides a small standardized set of core packages that serve as a universal foundation for building container images, host environments, and services that run in cloud infrastructures and on edge devices. More complex and specialized solutions can be created by adding additional packages on top of Azure Linux, but the base for all such systems remains unchanged, simplifying maintenance and update preparation.
For example, Azure Linux serves as the basis for the mini-distribution WSLg, which provides components of the graphical stack for running Linux GUI applications in environments based on the WSL2 (Windows Subsystem for Linux). Enhanced functionality in WSLg is implemented through the inclusion of additional packages with compositing support. proxy server Weston, XWayland, PulseAudio, and FreeRDP.
The system manager systemd is used for managing services and load. Package managers RPM and DNF are provided for package management. By default, the SSH server is not enabled. An installer is provided for installing the distribution, which can work in both text and graphical modes. The installer allows the installation of either a full or a minimal set of packages, offers an interface for selecting the disk partition, choosing the hostname, and creating users.
The Azure Linux build system enables the generation of both separate RPM packages based on SPEC files and source texts, as well as monolithic system images created with the rpm-ostree tool, which can be updated atomically without breaking them into individual packages. Accordingly, two models for delivering updates are supported: through updating individual packages and through rebuilding and updating the entire system image. A repository containing approximately 3000 already built RPM packages is available, which can be used to assemble custom images based on a configuration file.
The base platform includes only the most essential components and is optimized for minimal memory and disk space usage, as well as for high boot speed. The project employs a 'maximum security by default' approach, which implies the inclusion of various additional mechanisms to enhance protection:
- Filtering of system calls using the seccomp mechanism.
- Encryption of disk partitions.
- Verification of packages by digital signature.
- Address space randomization.
- Protection against attacks related to symbolic links, mmap, /dev/mem, and /dev/kmem.
- Read-only mode and prohibition of code execution in areas of memory where kernel and module data segments are located.
- Option to prohibit the loading of kernel modules after system initialization.
- Using iptables for network packet filtering.
- Enabling protection modes against stack overflow, buffer overflows, and string format issues (_FORTIFY_SOURCE, -fstack-protector, -Wformat-security, relro) during the build.
Source: opennet.ru
