Kutulutsidwa kwa kugawa kwa Linux Bottlerocket 1.3.0 kwasindikizidwa, kopangidwa ndi Amazon kutenga nawo gawo pakukhazikitsa koyenera komanso kotetezeka kwa zida zakutali. Zida zogawa ndi zida zowongolera zimalembedwa mu Rust ndikugawidwa pansi pa MIT ndi Apache 2.0. Imathandizira kuthamanga kwa Bottlerocket pamagulu a Amazon ECS, VMware ndi AWS EKS Kubernetes, komanso kupanga zomangira ndi zosintha zomwe zimalola kugwiritsa ntchito zida zosiyanasiyana zoyimba ndi nthawi yothamangitsira zotengera.
Kugawaku kumapereka chithunzithunzi cha atomiki komanso chosinthika chokha chomwe chimaphatikizapo kernel ya Linux komanso malo ocheperako, kuphatikiza zida zokhazo zofunika kuyendetsa zotengera. Chilengedwe chimaphatikizapo woyang'anira systemd system, laibulale ya Glibc, chida chomangira cha Buildroot, GRUB boot loader, woyimba network configurator, nthawi yosungiramo zida zakutali, nsanja ya Kubernetes yoimba nyimbo, aws-iam-authenticator, ndi Amazon. Wothandizira ECS.
Zida zoyimba ma Container zimabwera mu chidebe choyang'anira chosiyana chomwe chimayatsidwa mwachisawawa ndikuyendetsedwa kudzera pa API ndi AWS SSM Agent. Chithunzi choyambira chilibe chipolopolo cholamula, seva ya SSH ndi zilankhulo zotanthauziridwa (mwachitsanzo, palibe Python kapena Perl) - zida zoyang'anira ndi zida zowonongeka zimayikidwa mumtsuko wosiyana, womwe umayimitsidwa mwachisawawa.
Kusiyanitsa kwakukulu kuchokera ku magawo ofanana monga Fedora CoreOS, CentOS / Red Hat Atomic Host ndiye cholinga chachikulu chopereka chitetezo chokwanira pakulimbikitsa chitetezo cha machitidwe ku zoopsa zomwe zingatheke, zomwe zimapangitsa kuti zikhale zovuta kugwiritsa ntchito chiwopsezo mu zigawo za OS ndikuwonjezera kudzipatula kwa chidebe. . Zotengera zimapangidwa pogwiritsa ntchito makina a Linux kernel - magulu, malo a mayina ndi seccomp. Kudzipatula kwina, kugawa kumagwiritsa ntchito SELinux mu "kukakamiza" mode.
Gawo la mizu limayikidwa powerenga-pokha, ndipo gawo la / etc limayikidwa mu tmpfs ndikubwezeretsedwa ku chikhalidwe chake choyambirira mutayambiranso. Kusintha kwachindunji kwa mafayilo mu / etc directory, monga /etc/resolv.conf ndi /etc/containerd/config.toml, sikuthandizidwa - kuti musunge zoikamo kwamuyaya, muyenera kugwiritsa ntchito API kapena kusuntha ntchitoyo muzitsulo zosiyana. Gawo la dm-verity limagwiritsidwa ntchito kutsimikizira mwachinsinsi kukhulupirika kwa magawo a mizu, ndipo ngati kuyesa kusintha data pamlingo wa block chipangizo kuzindikirika, dongosolo limayambiranso.
Zida zambiri zamakina zimalembedwa mu Rust, zomwe zimapereka zinthu zoteteza kukumbukira kuti zipewe zovuta zomwe zimadza chifukwa cha kukumbukira kwaulere, kuchotsedwa kwa null pointer, ndi kupitilira kwa buffer. Mukamanga mwachisawawa, mitundu yophatikizira "-enable-default-pie" ndi "-enable-default-ssp" amagwiritsidwa ntchito kuti athetse kusanja kwa malo adilesi yafayilo (PIE) ndikutetezedwa ku kusefukira kwa stack kudzera m'malo mwa canary. Pamapaketi olembedwa mu C/C++, mbendera “-Wall”, “-Werror=format-security”, “-Wp,-D_FORTIFY_SOURCE=2”, “-Wp,-D_GLIBCXX_ASSERTIONS” ndi “-fstack-clash” ndi zinanso. kuthandizira -chitetezo".
M'kutulutsa kwatsopano:
- Zowonongeka zosasunthika mu docker ndi zida zogwiritsira ntchito nthawi yothamanga (CVE-2021-41089, CVE-2021-41091, CVE-2021-41092, CVE-2021-41103) zokhudzana ndi kukhazikitsidwa kolakwika kwa ufulu wofikira, zomwe zimalola ogwiritsa ntchito opanda mwayi kupitirira maziko. directory ndikuchita mapulogalamu akunja.
- Thandizo la IPv6 lawonjezedwa ku kubelet ndi pluto.
- Ndizotheka kuyambitsanso chidebe mutasintha zosintha zake.
- Thandizo la zochitika za Amazon EC2 M6i zawonjezedwa pa phukusi la eni-max-pods.
- Open-vm-tools yawonjezera chithandizo cha zosefera zida, kutengera zida za Cilium.
- Pa nsanja ya x86_64, njira ya hybrid boot mode imayendetsedwa (mothandizidwa ndi EFI ndi BIOS).
- Zosinthidwa za phukusi ndi zodalira za chinenero cha Rust.
- Thandizo lamitundu yogawa aws-k8s-1.17 yotengera Kubernetes 1.17 yathetsedwa. Ndikofunikira kugwiritsa ntchito mtundu wa aws-k8s-1.21 mothandizidwa ndi Kubernetes 1.21. Mitundu ya k8s imagwiritsa ntchito cgroup runtime.slice ndi system.slice zoikamo.
Source: opennet.ru