Kutulutsidwa kwa kugawa kwa Linux Bottlerocket 1.2.0 kulipo, kopangidwa ndi Amazon kutenga nawo gawo pakukhazikitsa koyenera komanso kotetezeka kwa zida zakutali. Zida zogawa ndi zida zowongolera zimalembedwa mu Rust ndikugawidwa pansi pa MIT ndi Apache 2.0. Imathandizira kuthamanga kwa Bottlerocket ku Amazon ECS, VMware ndi AWS EKS Kubernetes masango, komanso kupanga zomangira ndi zosintha zomwe zimalola kugwiritsa ntchito zida zosiyanasiyana zoyimba ndi nthawi yothamangitsira zotengera.
Kugawaku kumapereka chithunzithunzi cha atomiki komanso chosinthika chokha chomwe chimaphatikizapo kernel ya Linux komanso malo ocheperako, kuphatikiza zida zokhazo zofunika kuyendetsa zotengera. Chilengedwe chimaphatikizapo woyang'anira systemd system, laibulale ya Glibc, chida chomangira cha Buildroot, GRUB boot loader, woyimba network configurator, nthawi yosungiramo zida zakutali, nsanja ya Kubernetes yoimba nyimbo, aws-iam-authenticator, ndi Amazon. Wothandizira ECS.
Zida zoyimba ma Container zimabwera mu chidebe choyang'anira chosiyana chomwe chimayatsidwa mwachisawawa ndikuyendetsedwa kudzera pa API ndi AWS SSM Agent. Chithunzi choyambira chilibe chipolopolo cholamula, seva ya SSH ndi zilankhulo zotanthauziridwa (mwachitsanzo, palibe Python kapena Perl) - zida zoyang'anira ndi zida zowonongeka zimayikidwa mumtsuko wosiyana, womwe umayimitsidwa mwachisawawa.
Kusiyanitsa kwakukulu kuchokera ku magawo ofanana monga Fedora CoreOS, CentOS / Red Hat Atomic Host ndiye cholinga chachikulu chopereka chitetezo chokwanira pakulimbikitsa chitetezo cha machitidwe ku zoopsa zomwe zingatheke, zomwe zimapangitsa kuti zikhale zovuta kugwiritsa ntchito chiwopsezo mu zigawo za OS ndikuwonjezera kudzipatula kwa chidebe. . Zotengera zimapangidwa pogwiritsa ntchito makina a Linux kernel - magulu, malo a mayina ndi seccomp. Kudzipatula kwina, kugawa kumagwiritsa ntchito SELinux mu "kukakamiza" mode.
Gawo la mizu limayikidwa powerenga-pokha, ndipo gawo la / etc limayikidwa mu tmpfs ndikubwezeretsedwa ku chikhalidwe chake choyambirira mutayambiranso. Kusintha kwachindunji kwa mafayilo mu / etc directory, monga /etc/resolv.conf ndi /etc/containerd/config.toml, sikuthandizidwa - kuti musunge zoikamo kwamuyaya, muyenera kugwiritsa ntchito API kapena kusuntha ntchitoyo muzitsulo zosiyana. Gawo la dm-verity limagwiritsidwa ntchito kutsimikizira mwachinsinsi kukhulupirika kwa magawo a mizu, ndipo ngati kuyesa kusintha data pamlingo wa block chipangizo kuzindikirika, dongosolo limayambiranso.
Zida zambiri zamakina zimalembedwa mu Rust, zomwe zimapereka zinthu zoteteza kukumbukira kuti zipewe zovuta zomwe zimadza chifukwa cha kukumbukira kwaulere, kuchotsedwa kwa null pointer, ndi kupitilira kwa buffer. Mukamanga mwachisawawa, mitundu yophatikizira "-enable-default-pie" ndi "-enable-default-ssp" amagwiritsidwa ntchito kuti athetse kusanja kwa malo adilesi yafayilo (PIE) ndikutetezedwa ku kusefukira kwa stack kudzera m'malo mwa canary. Pamapaketi olembedwa mu C/C++, mbendera “-Wall”, “-Werror=format-security”, “-Wp,-D_FORTIFY_SOURCE=2”, “-Wp,-D_GLIBCXX_ASSERTIONS” ndi “-fstack-clash” ndi zinanso. kuthandizira -chitetezo".
M'kutulutsa kwatsopano:
- Thandizo lowonjezera la magalasi a registry image.
- Adawonjezera kuthekera kogwiritsa ntchito ziphaso zodzisainira.
- Njira yowonjezeredwa yokonza dzina la alendo.
- Mtundu wosasinthika wa chotengera choyang'anira wasinthidwa.
- Zosintha za topologyManagerPolicy ndi topologyManagerScope za kubelet.
- Thandizo lowonjezera la kupsinjika kwa kernel pogwiritsa ntchito zstd algorithm.
- Kutha kuyika makina enieni mu VMware mu mtundu wa OVA (Open Virtualization Format) kwaperekedwa.
- Mtundu wogawa aws-k8s-1.21 wasinthidwa mothandizidwa ndi Kubernetes 1.21. Thandizo la aws-k8s-1.16 lathetsedwa.
- Zosinthidwa za phukusi ndi zodalira za chinenero cha Rust.
Source: opennet.ru