{"id":94205,"date":"2020-09-13T19:42:49","date_gmt":"2020-09-13T17:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vyshel-minimalistichnyj-linux-distributiv-bottlerocket-dlya-zapuska-kontejnerov-samoe-glavnoe-o-nyom"},"modified":"2020-09-13T19:42:49","modified_gmt":"2020-09-13T17:42:49","slug":"vyshel-minimalistichnyj-linux-distributiv-bottlerocket-dlya-zapuska-kontejnerov-samoe-glavnoe-o-nyom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vyshel-minimalistichnyj-linux-distributiv-bottlerocket-dlya-zapuska-kontejnerov-samoe-glavnoe-o-nyom","title":{"rendered":"A minimalist Linux distribution Bottlerocket has been released for running containers. The most important things about it","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"A
\n
\nAmazon announced<\/a><\/noindex> about the final release Bottlerocket<\/a><\/noindex> \u2014 a specialized distribution for running containers and managing them effectively.<\/p>\n

Bottlerocket (by the way, it\u2019s also the name for small homemade rockets using black powder) is not the first OS for containers, but it is likely to gain wide adoption due to its default integration with AWS services. Although the system is cloud-focused on Amazon, its open-source code allows it to be built anywhere: locally on a server, on a Raspberry Pi, in any competing cloud, and even in a non-containerized environment.<\/p>\n

This is a worthy replacement for the CoreOS distribution, which was discontinued by Red Hat.
\n<\/a><\/noindex>
\nIn fact, Amazon Web Services already has Amazon Linux, which recently released its second version: a general-purpose distribution that can be run in a Docker container or with Linux KVM, Microsoft Hyper-V, and VMware ESXi hypervisors. It has been optimized for working in the AWS cloud, but with the release of Bottlerocket, everyone is encouraged to upgrade to the new system, which is more secure, modern, and resource-efficient.<\/p>\n

AWS announced Bottlerocket in March 2020<\/a><\/noindex>. It immediately acknowledged that this is not the first \"Linux for containers,\" citing sources of inspiration like CoreOS, Rancher OS, and Project Atomic. The developers stated that the operating system is the \"result of lessons learned from years of operating production services at scale at Amazon, and based on the experiences we've gained over the past six years about running containers.\"<\/p>\n

Extreme Minimalism<\/h1>\n

\nLinux is stripped down of everything unnecessary for running containers. This design, according to the company, reduces the attack surface.<\/p>\n

This means that fewer packages are installed in the base system, simplifying OS maintenance and updates, while also lowering the likelihood of issues arising from dependencies, reducing resource usage. Essentially, everything runs inside separate containers, while the base system is practically bare.<\/p>\n

Amazon has also removed all shells and interpreters, eliminating the risk of their use or accidental privilege escalation by users. The base image lacks a command shell, SSH server, and interpreted languages like Python for minimalism and security. Administration tools are moved to a separate service container, which is disabled by default.<\/p>\n

System management is provided in two ways: through the API and orchestration.<\/p>\n

Instead of a package manager that updates individual parts of the software, Bottlerocket downloads a complete filesystem image and reboots into it. In case of boot failure, it automatically rolls back, and a workload failure can initiate a manual rollback (command through API).<\/p>\n

Framework TUF<\/a><\/noindex> (The Update Framework) loads updates based on images into alternate or 'unmounted' partitions. Two disk partitions are allocated for the system, one containing the active system and the other receiving the update. The root partition is mounted read-only, while the partition \/etc<\/code> is mounted with the filesystem in memory. tmpfs<\/a><\/noindex> and restores the original state after reboot. Direct modification of configuration files in \/etc<\/code> is not supported: to save settings, use the API or offload functionality to separate containers.<\/p>\n

\"A
\nUpdate scheme via API<\/i><\/p>\n

Security<\/h1>\n

\nContainers are created using standard Linux kernel mechanisms \u2014 cgroups, namespaces, and seccomp, and for access control enforcement, additional isolation is provided by SELinux<\/a><\/noindex> in \"enforcing\" mode.<\/p>\n

By default, policies are enabled to separate resources between containers and the kernel. Binaries are protected by flags, preventing users or programs from executing them. And if someone accesses the filesystem, Bottlerocket offers a tool to check and track any changes made.<\/p>\n

The 'verified boot' mode is implemented through the device-mapper-verity function (dm-verity<\/a><\/noindex>), which checks the integrity of the root partition during boot. AWS describes dm-verity as \u201ca Linux kernel feature that provides integrity checking to prevent malware from running in the OS, such as overwriting essential system software.\u201d<\/p>\n

Also in the system is a filter eBPF<\/a><\/noindex> (extended BPF, developed by Alexey Starovoitov<\/a><\/noindex>), which allows replacing kernel modules with safer BPF programs for low-level system operations.<\/p>\n

Execution model
\nUser-defined
\nCompilation
\nSecurity
\nFailure mode
\nResource access<\/p>\n

User<\/b>
\ntask
\nyes
\nany
\nuser privileges
\nexecution interruption
\nsystem call, fault<\/p>\n

Kernel<\/b>
\ntask
\nnone
\nstatic
\nnone
\nkernel panic
\ndirect<\/p>\n

BPF<\/b>
\nevent
\nyes
\nJIT, CO-RE
\nverification, JIT
\nerror message
\nrestricted helpers<\/p>\n

\nThe difference between BPF and regular user or kernel-level code is that source<\/a><\/noindex><\/i><\/p>\n

AWS stated that Bottlerocket \u201capplies an operational model that further enhances security, preventing connection to production servers with administrator privileges\u201d and \u201cis suitable for large distributed systems where control over each individual host is limited.\u201d<\/p>\n

For system administrators, there is an admin container. But AWS doesn\u2019t believe that admin will often need to work inside Bottlerocket: \u201cThe act of logging into an individual instance of Bottlerocket is intended for infrequent operations: advanced debugging and troubleshooting,\u201d writes<\/a><\/noindex> the developers.<\/p>\n

Rust language<\/h1>\n

\nThe OS toolkit above the kernel is mainly written in Rust. This language inherently reduces the likelihood of unsafe memory access<\/a><\/noindex>, as well as eliminates race conditions between threads<\/a><\/noindex>.<\/p>\n

By default, the following flags are applied --enable-default-pie<\/code> and --enable-default-ssp<\/code> to enable address space layout randomization for executables (position-independent executable<\/a><\/noindex>, PIE) and stack overflow protection.<\/p>\n

For C\/C++ packages, additional flags are included -Wall<\/code>, -Werror=format-security<\/code>, -Wp,-D_FORTIFY_SOURCE=2<\/code>, -Wp,-D_GLIBCXX_ASSERTIONS<\/code> and -fstack-clash-protection<\/code>.<\/p>\n

Besides Rust and C\/C++, some packages are written in Go.<\/p>\n

Integration with AWS services<\/h1>\n

\nThe difference from similar container operating systems is that Amazon has optimized Bottlerocket for work on AWS and integration with other AWS services.<\/p>\n

The most popular container orchestrator is Kubernetes, which is why AWS has implemented integration with its own Enterprise Kubernetes Service (EKS). Orchestration tools come in a separate management container bottlerocket-control-container<\/a><\/noindex>, which is enabled by default and managed through the API and AWS SSM Agent.<\/p>\n

It will be interesting to see if Bottlerocket takes off, considering the failures of some similar initiatives in the past. For example, PhotonOS from VMware went unused, and RedHat acquired CoreOS and shut down the project<\/a><\/noindex>, which was considered a pioneer in the field.<\/p>\n

Bottlerocket's integration into AWS services makes this system unique in its own right. This may be the main reason why some users might prefer Bottlerocket over other distributions like CoreOS or Alpine. The system is originally designed to work with EKS and ECS, but let's reiterate that this is not mandatory. Firstly, Bottlerocket can be built from scratch<\/a><\/noindex> and used, for example, as a hosted solution. Secondly, users of EKS and ECS will still retain the option to choose their OS.<\/p>\n

The source code of Bottlerocket is published on GitHub under the Apache 2.0 license. Developers are already responding to bug reports and feature requests<\/a><\/noindex>.<\/p>\n

<\/p>\n

Advertising<\/h4>\n

\nVDSina<\/b> offers VDS with daily payment<\/a><\/noindex>. You can install any operating system, including from your own image. Each server is connected to a 500 Megabit internet channel and is free from DDoS attacks! <\/p>\n

\"A<\/a><\/noindex>
\n
Source: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Amazon \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0435 Bottlerocket \u2014 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043c\u0438. Bottlerocket (\u043a\u0441\u0442\u0430\u0442\u0438, \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043c\u0435\u043b\u043a\u0438\u0435 \u0441\u0430\u043c\u043e\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u043a\u0435\u0442\u044b \u043d\u0430 \u0434\u044b\u043c\u043d\u043e\u043c \u043f\u043e\u0440\u043e\u0445\u0435) \u2014 \u043d\u0435 \u043f\u0435\u0440\u0432\u0430\u044f \u041e\u0421 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043d\u043e \u0432\u043f\u043e\u043b\u043d\u0435 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438 AWS. \u0425\u043e\u0442\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u043e\u0431\u043b\u0430\u043a\u043e Amazon, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94206,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A minimalist Linux distribution Bottlerocket has been released for running containers. The most important details about it | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vyshel-minimalistichnyj-linux-distributiv-bottlerocket-dlya-zapuska-kontejnerov-samoe-glavnoe-o-nyom","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u0448\u0435\u043b \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Bottlerocket \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0421\u0430\u043c\u043e\u0435 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 \u043e \u043d\u0451\u043c | ProHoster","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vyshel-minimalistichnyj-linux-distributiv-bottlerocket-dlya-zapuska-kontejnerov-samoe-glavnoe-o-nyom","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-13T17:42:49+00:00","article:modified_time":"2020-09-13T17:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94205","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:31:27","updated":"2022-10-03 07:42:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/94205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=94205"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/94205\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/94206"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=94205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=94205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=94205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}