{"id":100122,"date":"2021-05-08T22:22:43","date_gmt":"2021-05-08T20:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov"},"modified":"2021-05-08T22:22:43","modified_gmt":"2021-05-08T20:22:43","slug":"vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov","title":{"rendered":"Lansarea Bottlerocket 1.1, o distribu\u021bie bazat\u0103 pe containere izolate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Este disponibil\u0103 lansarea distribu\u021biei Linux Bottlerocket 1.1.0, dezvoltat\u0103 cu ajutorul companiei Amazon pentru a permite rularea eficient\u0103 \u0219i sigur\u0103 a containerelor izolate. Instrumentele \u0219i componentele de gestionare ale distribu\u021biei sunt scrise \u00een Rust \u0219i sunt distribuite sub licen\u021bele MIT \u0219i Apache 2.0. Bottlerocket este compatibil cu clusterele Amazon ECS \u0219i AWS EKS Kubernetes, precum \u0219i cu crearea de build-uri \u0219i variante personalizate care permit utilizarea diferitelor instrumente de orchestrare \u0219i runtime pentru containere.      <\/p>\n<p>Distribu\u021bia ofer\u0103 o imagine de sistem atomic\u0103 \u0219i actualizabil\u0103 automat, indisolubil\u0103, care include kernelul Linux \u0219i un mediu de sistem minim, incluz\u00e2nd doar componentele necesare pentru rularea containerelor. \u00cen mediu sunt implicate managerul de sistem systemd, biblioteca Glibc, instrumentele de construc\u021bie Buildroot, bootloader-ul GRUB, configuratorul de re\u021bea wicked, runtime-ul pentru containere izolate containerd, platforma de orchestrare a containerelor Kubernetes, autentificatorul aws-iam-authenticator \u0219i agentul Amazon ECS.     <\/p>\n<p>Instrumentele pentru orchestrarea containerelor sunt furnizate \u00eentr-un container de gestionare separat, care este activat \u00een mod implicit \u0219i gestionat prin API \u0219i AWS SSM Agent. Imaginea de baz\u0103 nu con\u021bine un shell de comand\u0103, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/\"   title=\"serverul\" data-wpil-keyword-link=\"linked\">serverul<\/a> SSH \u0219i limbajele interpretate (de exemplu, nu Python sau Perl) \u2014 instrumente pentru administratori \u0219i unelte de depanare sunt scoase \u00eentr-un container de servicii separat, care este dezactivat \u00een mod implicit.       <\/p>\n<p>Principala diferen\u021b\u0103 fa\u021b\u0103 de distribu\u021biile similare, cum ar fi Fedora CoreOS, CentOS\/Red Hat Atomic Host, este orientarea primar\u0103 spre asigurarea securit\u0103\u021bii maximale \u00een contextul \u00eent\u0103ririi protec\u021biei sistemului \u00eempotriva amenin\u021b\u0103rilor poten\u021biale, complic\u0103rii exploat\u0103rii vulnerabilit\u0103\u021bilor \u00een componentele sistemului de operare \u0219i cre\u0219terii izol\u0103rii containerelor. Containerele sunt create folosind mecanismele standard ale nucleului Linux \u2014 cgroups, spa\u021bii de nume \u0219i seccomp. Pentru o izolare suplimentar\u0103, distribu\u021bia utilizeaz\u0103 SELinux \u00een modul \u201eenforcing\u201d.    <\/p>\n<p>Parti\u021bia r\u0103d\u0103cin\u0103 este montat\u0103 \u00een mod read-only, iar parti\u021bia cu configura\u021bii \/etc este montat\u0103 \u00een tmpfs \u0219i \u00ee\u0219i restabile\u0219te starea ini\u021bial\u0103 dup\u0103 repornire. Modificarea direct\u0103 a fi\u0219ierelor din directorul \/etc, cum ar fi \/etc\/resolv.conf \u0219i \/etc\/containerd\/config.toml, nu este acceptat\u0103 \u2014 pentru salvarea permanent\u0103 a set\u0103rilor, trebuie folosit API-ul sau scoas\u0103 func\u021bionalitatea \u00een containere separate. Pentru verificarea criptografic\u0103 a integrit\u0103\u021bii parti\u021biei r\u0103d\u0103cin\u0103 este folosit modul dm-verity, iar \u00een cazul detect\u0103rii unei tentative de modificare a datelor la nivelul dispozitivului de bloc, sistemul se reporne\u0219te.       <\/p>\n<p>Cele mai multe componente ale sistemului sunt scrise \u00een limbajul Rust, care ofer\u0103 instrumente pentru o manipulare sigur\u0103 a memoriei, evit\u00e2nd vulnerabilit\u0103\u021bile cauzate de accesarea zonei de memorie dup\u0103 eliberare, dereferen\u021bierea pointerilor nuli \u0219i dep\u0103\u0219irea limitelor buffer-ului. La compilare, se aplic\u0103 \u00een mod implicit modurile de compilare \u201e--enable-default-pie\u201d \u0219i \u201e--enable-default-ssp\u201d pentru a activa randomizarea spa\u021biului de adrese ale fi\u0219ierelor executabile (PIE) \u0219i protec\u021bia \u00eempotriva dep\u0103\u0219irii stivei prin \u00eenlocuirea etichetelor de canari. Pentru pachetele scrise \u00een C\/C++, se includ suplimentar flag-uri \u201e-Wall\u201d, \u201e-Werror=format-security\u201d, \u201e-Wp,-D_FORTIFY_SOURCE=2\u201d, \u201e-Wp,-D_GLIBCXX_ASSERTIONS\u201d \u0219i \u201e-fstack-clash-protection\u201d.    <\/p>\n<p>\u00cen noua versiune:  <\/p>\n<ul>\n<li class=\"l\"> Au fost propuse dou\u0103 noi variante ale distribu\u021biei aws-k8s-1.20 \u0219i vmware-k8s-1.20 cu suport pentru Kubernetes 1.20. Aceste variante, precum \u0219i versiunea actualizat\u0103 aws-ecs-1, utilizeaz\u0103 un nou release al nucleului Linux 5.10. Modul lockdown este, \u00een mod implicit, setat la valoarea &#171;integrity&#187; (accesul care permite modificarea nucleului \u00een func\u021bionare din spa\u021biul utilizatorului este blocat). Suportul pentru varianta aws-k8s-1.15 bazat\u0103 pe Kubernetes 1.15 a fost \u00eentrerupt.\n<li class=\"l\"> Pentru Amazon ECS a fost implementat suportul pentru modul de re\u021bea awsvpc, care permite alocarea de interfe\u021be de re\u021bea distincte \u0219i interne <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/lir\/ipv4\/\"   title=\"adrese IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"682\">adrese IP<\/a> pentru fiecare sarcin\u0103.\n<li class=\"l\"> Au fost ad\u0103ugate set\u0103ri pentru a gestiona diferite parametri ai Kubernetes, inclusiv QPS, limit\u0103ri pe pool-uri \u0219i posibilitatea de a se conecta la furnizori de cloud diferi\u021bi de AWS.\n<li class=\"l\"> \u00cen containerul de bootstrap a fost asigurat un control de acces la datele utilizatorului prin intermediul SELinux.\n<li class=\"l\"> A fost ad\u0103ugat\u0103 utilitara resize2fs.      <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55109\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.1.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u044f\u043c\u0438 MIT \u0438 Apache 2.0. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u043a Bottlerocket \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Amazon ECS \u0438 AWS EKS Kubernetes, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a \u0438 \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100122","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.1.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bottlerocket 1.1, \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.1.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-05-08T20:22:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-05-08T20:22:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea Bottlerocket 1.1, o distribu\u021bie bazat\u0103 pe acele containere izolate | ProHoster","description":"A fost lansat\u0103 versiunea 1.1.0 a distribu\u021biei Linux Bottlerocket, dezvoltat\u0103 cu participarea companiei Amazon pentru lansarea eficient\u0103 \u0219i sigur\u0103 a containerelor izolate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bottlerocket 1.1, \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.1.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-1-distributiva-na-baze-izolirovannyh-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-08T20:22:43+00:00","article:modified_time":"2021-05-08T20:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100122","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-09 14:46:00","updated":"2026-02-08 20:24:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100122"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100122\/revisions"}],"predecessor-version":[{"id":172927,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100122\/revisions\/172927"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}