The release of the Bottlerocket 1.7.0 Linux distribution, developed with the involvement of Amazon for the efficient and secure launch of isolated containers, has been announced. The tools and management components of the distribution are written in Rust and are distributed under the MIT and Apache 2.0 licenses. Bottlerocket supports deployment in Amazon ECS clusters, VMware, and AWS EKS Kubernetes, as well as the creation of custom builds and editions that allow the use of various orchestration tools and runtimes for containers.
The distribution provides an atomically and automatically updatable immutable system image, which includes the Linux kernel and a minimal system environment, containing only the components necessary to run containers. The environment employs the system manager systemd, the Glibc library, the Buildroot build toolchain, the GRUB bootloader, the wicked network configurator, the runtime for isolated containers containerd, the Kubernetes container orchestration platform, the aws-iam-authenticator authenticator, and the Amazon ECS agent.
Container orchestration tools are provided in a separate management container, which is included by default and managed via the API and AWS SSM Agent. The base image does not include a command shell, server SSH and interpreted languages (such as Python or Perl) are not included; administrator tools and debugging are offloaded to a separate service container, which is disabled by default.
The key difference from similar distributions, such as Fedora CoreOS and CentOS/Red Hat Atomic Host, is the primary focus on providing maximum security in the context of enhancing system protection against potential threats, complicating the exploitation of vulnerabilities in OS components, and increasing container isolation. Containers are created using native Linux kernel mechanisms: cgroups, namespaces, and seccomp. For additional isolation, SELinux is used in 'enforcing' mode.
The root partition is mounted in read-only mode, while the configuration partition /etc is mounted in tmpfs and resets to its original state after a reboot. Direct modification of files in the /etc directory, such as /etc/resolv.conf and /etc/containerd/config.toml, is not supported; use the API for permanent settings storage or externalize functionality in separate containers. The dm-verity module is used for cryptographic verification of the root partition's integrity, and in case of any modification attempts at the block device level, the system reboots.
Most system components are written in Rust, which provides tools for safe memory handling, helping to avoid vulnerabilities caused by accessing freed memory, dereferencing null pointers, and buffer overflows. The default build modes include "--enable-default-pie" and "--enable-default-ssp" to enable Position Independent Executable (PIE) address space randomization and stack overflow protection through canary substitutions. For packages written in C/C++, additional flags "-Wall", "-Werror=format-security", "-Wp,-D_FORTIFY_SOURCE=2", "-Wp,-D_GLIBCXX_ASSERTIONS", and "-fstack-clash-protection" are also enabled.
In the new release:
- When installing RPM packages, a list of programs in JSON format is generated and mounted in the host container as the file /var/lib/bottlerocket/inventory/application.json to provide information about the available packages.
- The 'admin' and 'control' containers have been updated.
- Package versions and dependencies for Go and Rust languages have been updated.
- Versions of third-party software packages have been updated.
- Issues with the tmpfilesd configuration for kmod-5.10-nvidia have been resolved.
- When installing tuftool, dependency version bindings have been ensured.
Source: opennet.ru
