The release of the Linux distribution Bottlerocket 1.2.0, developed with the support of Amazon for efficient and secure launching of isolated containers, is now available. The tools and management components of the distribution are written in Rust and distributed under the MIT and Apache 2.0 licenses. Bottlerocket is supported for deployment in Amazon ECS clusters, VMware, and AWS EKS Kubernetes, along with the ability to create custom builds and editions that allow the use of various orchestration tools and runtimes for containers.
The distribution provides an atomically and automatically updatable immutable system image, which includes the Linux kernel and a minimal system environment, containing only the components necessary to run containers. The environment employs the system manager systemd, the Glibc library, the Buildroot build toolchain, the GRUB bootloader, the wicked network configurator, the runtime for isolated containers containerd, the Kubernetes container orchestration platform, the aws-iam-authenticator authenticator, and the Amazon ECS agent.
Container orchestration tools are provided in a separate management container, which is included by default and managed via the API and AWS SSM Agent. The base image does not include a command shell, server SSH and interpreted languages (such as Python or Perl) are not included; administrator tools and debugging are offloaded to a separate service container, which is disabled by default.
The key difference from similar distributions, such as Fedora CoreOS and CentOS/Red Hat Atomic Host, is the primary focus on providing maximum security in the context of enhancing system protection against potential threats, complicating the exploitation of vulnerabilities in OS components, and increasing container isolation. Containers are created using native Linux kernel mechanisms: cgroups, namespaces, and seccomp. For additional isolation, SELinux is used in 'enforcing' mode.
The root partition is mounted in read-only mode, while the configuration partition /etc is mounted in tmpfs and resets to its original state after a reboot. Direct modification of files in the /etc directory, such as /etc/resolv.conf and /etc/containerd/config.toml, is not supported; use the API for permanent settings storage or externalize functionality in separate containers. The dm-verity module is used for cryptographic verification of the root partition's integrity, and in case of any modification attempts at the block device level, the system reboots.
Most system components are written in Rust, which provides tools for safe memory handling, helping to avoid vulnerabilities caused by accessing freed memory, dereferencing null pointers, and buffer overflows. The default build modes include "--enable-default-pie" and "--enable-default-ssp" to enable Position Independent Executable (PIE) address space randomization and stack overflow protection through canary substitutions. For packages written in C/C++, additional flags "-Wall", "-Werror=format-security", "-Wp,-D_FORTIFY_SOURCE=2", "-Wp,-D_GLIBCXX_ASSERTIONS", and "-fstack-clash-protection" are also enabled.
In the new release:
- Support for container image registry mirrors has been added.
- The ability to use self-signed certificates has been added.
- A parameter for configuring the hostname has been added.
- The version of the default administrative container has been updated.
- The topologyManagerPolicy and topologyManagerScope settings for kubelet have been added.
- Support for kernel compression using the zstd algorithm has been added.
- The ability to boot in VMware has been provided. of virtual machines in OVA (Open Virtualization Format).
- The aws-k8s-1.21 distribution version has been updated to support Kubernetes 1.21. Support for aws-k8s-1.16 has been discontinued.
- Package versions and dependencies for the Rust language have been updated.
Source: opennet.ru
