{"id":101560,"date":"2021-10-07T10:23:00","date_gmt":"2021-10-07T08:23:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bottlerocket-1-3-distributiva-na-baze-izolirovannyh-kontejnerov"},"modified":"2021-10-07T10:23:00","modified_gmt":"2021-10-07T08:23:00","slug":"vypusk-bottlerocket-1-3-distributiva-na-baze-izolirovannyh-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-bottlerocket-1-3-distributiva-na-baze-izolirovannyh-kontejnerov","title":{"rendered":"Bottlerocket 1.3 Release: A Distribution Based on Isolated Containers","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The release of the Linux distribution Bottlerocket 1.3.0 has been announced, developed with the participation of Amazon for efficient and secure microservices deployment. The tools and control components of the distribution are written in Rust and distributed under the MIT and Apache 2.0 licenses. Bottlerocket can run in Amazon ECS clusters, VMware, and AWS EKS Kubernetes, and supports the creation of custom builds and editions that allow the use of various orchestration tools and runtimes for containers. <\/p>\n

The distribution provides an atomically and automatically updatable immutable system image, which includes the Linux kernel and a minimal system environment, containing only the components necessary to run containers. The environment employs the system manager systemd, the Glibc library, the Buildroot build toolchain, the GRUB bootloader, the wicked network configurator, the runtime for isolated containers containerd, the Kubernetes container orchestration platform, the aws-iam-authenticator authenticator, and the Amazon ECS agent. <\/p>\n

Container orchestration tools are provided in a separate management container, which is included by default and managed via the API and AWS SSM Agent. The base image does not include a command shell, server<\/a> SSH and interpreted languages (such as Python or Perl) \u2014 tools for administrators and debugging are isolated in a separate service container that is disabled by default. <\/p>\n

The key distinction from similar distributions like Fedora CoreOS and CentOS\/Red Hat Atomic Host is the primary focus on providing maximum security in the context of enhancing system protection against potential threats, complicating the exploitation of vulnerabilities in OS components, and increasing container isolation. Containers are created using standard Linux kernel mechanisms \u2014 cgroups, namespaces, and seccomp. For additional isolation, the distribution employs SELinux in 'enforcing' mode. <\/p>\n

The root partition is mounted in read-only mode, and the settings partition \/etc is mounted in tmpfs and restores its original state after a reboot. Direct changes to files in the \/etc directory, such as \/etc\/resolv.conf and \/etc\/containerd\/config.toml, are not supported \u2014 for persistent settings, the API should be used, or functionality should be offloaded to separate containers. The dm-verity module is used for cryptographic verification of the root partition's integrity, and if any attempts to modify data at the block device level are detected, the system will reboot. <\/p>\n

Most system components are written in Rust, providing means for safe memory handling that prevent vulnerabilities caused by accessing memory after it has been freed, dereferencing null pointers, and buffer overflows. By default, the compilation modes '--enable-default-pie' and '--enable-default-ssp' are applied to enable position-independent executables (PIE) and stack overflow protection through canary substitution. For packages written in C\/C++, additional flags '-Wall', '-Werror=format-security', '-Wp,-D_FORTIFY_SOURCE=2', '-Wp,-D_GLIBCXX_ASSERTIONS', and '-fstack-clash-protection' are included. <\/p>\n

In the new release: <\/p>\n