{"id":103663,"date":"2022-03-31T15:36:53","date_gmt":"2022-03-31T13:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov"},"modified":"2022-03-31T15:36:53","modified_gmt":"2022-03-31T13:36:53","slug":"vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov","title":{"rendered":"Lansarea Bottlerocket 1.7, un distribuitor bazat pe containere izolate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost publicat\u0103 versiunea 1.7.0 a distribu\u021biei Linux Bottlerocket, dezvoltat\u0103 cu participarea companiei Amazon pentru lansarea eficient\u0103 \u0219i sigur\u0103 a containerelor izolate. Instrumentele \u0219i componentele de gestionare ale distribu\u021biei sunt scrise \u00een Rust \u0219i sunt distribute sub licen\u021bele MIT \u0219i Apache 2.0. Bottlerocket este suportat \u00een clusterele Amazon ECS, VMware \u0219i AWS EKS Kubernetes, precum \u0219i pentru crearea de build-uri \u0219i edi\u021bii personalizate, care permit utilizarea diverselor instrumente de orchestration \u0219i runtime pentru containere.      <\/p>\n<p>Distribu\u021bia ofer\u0103 o imagine de sistem atomic\u0103 \u0219i actualizabil\u0103 automat, indisolubil\u0103, care include kernelul Linux \u0219i un mediu de sistem minim, incluz\u00e2nd doar componentele necesare pentru rularea containerelor. \u00cen mediu sunt implicate managerul de sistem systemd, biblioteca Glibc, instrumentele de construc\u021bie Buildroot, bootloader-ul GRUB, configuratorul de re\u021bea wicked, runtime-ul pentru containere izolate containerd, platforma de orchestrare a containerelor Kubernetes, autentificatorul aws-iam-authenticator \u0219i agentul Amazon ECS.     <\/p>\n<p>Instrumentele pentru orchestrarea containerelor sunt furnizate \u00eentr-un container de gestionare separat, care este activat \u00een mod implicit \u0219i gestionat prin API \u0219i AWS SSM Agent. Imaginea de baz\u0103 nu con\u021bine un shell de comand\u0103, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/\"   title=\"serverul\" data-wpil-keyword-link=\"linked\">serverul<\/a> SSH \u0219i limbajele interpretate (de exemplu, nu Python sau Perl) \u2014 instrumente pentru administratori \u0219i unelte de depanare sunt scoase \u00eentr-un container de servicii separat, care este dezactivat \u00een mod implicit.       <\/p>\n<p>Principala diferen\u021b\u0103 fa\u021b\u0103 de distribu\u021biile similare, cum ar fi Fedora CoreOS, CentOS\/Red Hat Atomic Host, este orientarea primar\u0103 spre asigurarea securit\u0103\u021bii maximale \u00een contextul \u00eent\u0103ririi protec\u021biei sistemului \u00eempotriva amenin\u021b\u0103rilor poten\u021biale, complic\u0103rii exploat\u0103rii vulnerabilit\u0103\u021bilor \u00een componentele sistemului de operare \u0219i cre\u0219terii izol\u0103rii containerelor. Containerele sunt create folosind mecanismele standard ale nucleului Linux \u2014 cgroups, spa\u021bii de nume \u0219i seccomp. Pentru o izolare suplimentar\u0103, distribu\u021bia utilizeaz\u0103 SELinux \u00een modul \u201eenforcing\u201d.    <\/p>\n<p>Parti\u021bia r\u0103d\u0103cin\u0103 este montat\u0103 \u00een mod read-only, iar parti\u021bia cu configura\u021bii \/etc este montat\u0103 \u00een tmpfs \u0219i \u00ee\u0219i restabile\u0219te starea ini\u021bial\u0103 dup\u0103 repornire. Modificarea direct\u0103 a fi\u0219ierelor din directorul \/etc, cum ar fi \/etc\/resolv.conf \u0219i \/etc\/containerd\/config.toml, nu este acceptat\u0103 \u2014 pentru salvarea permanent\u0103 a set\u0103rilor, trebuie folosit API-ul sau scoas\u0103 func\u021bionalitatea \u00een containere separate. Pentru verificarea criptografic\u0103 a integrit\u0103\u021bii parti\u021biei r\u0103d\u0103cin\u0103 este folosit modul dm-verity, iar \u00een cazul detect\u0103rii unei tentative de modificare a datelor la nivelul dispozitivului de bloc, sistemul se reporne\u0219te.       <\/p>\n<p>Cele mai multe componente ale sistemului sunt scrise \u00een limbajul Rust, care ofer\u0103 instrumente pentru o manipulare sigur\u0103 a memoriei, evit\u00e2nd vulnerabilit\u0103\u021bile cauzate de accesarea zonei de memorie dup\u0103 eliberare, dereferen\u021bierea pointerilor nuli \u0219i dep\u0103\u0219irea limitelor buffer-ului. La compilare, se aplic\u0103 \u00een mod implicit modurile de compilare \u201e--enable-default-pie\u201d \u0219i \u201e--enable-default-ssp\u201d pentru a activa randomizarea spa\u021biului de adrese ale fi\u0219ierelor executabile (PIE) \u0219i protec\u021bia \u00eempotriva dep\u0103\u0219irii stivei prin \u00eenlocuirea etichetelor de canari. Pentru pachetele scrise \u00een C\/C++, se includ suplimentar flag-uri \u201e-Wall\u201d, \u201e-Werror=format-security\u201d, \u201e-Wp,-D_FORTIFY_SOURCE=2\u201d, \u201e-Wp,-D_GLIBCXX_ASSERTIONS\u201d \u0219i \u201e-fstack-clash-protection\u201d.    <\/p>\n<p>\u00cen noua versiune:  <\/p>\n<ul>\n<li class=\"l\"> La instalarea pachetelor RPM, se asigur\u0103 generarea unei liste de programe \u00een format JSON \u0219i montarea acesteia \u00een containerul host ca fi\u0219ier \/var\/lib\/bottlerocket\/inventory\/application.json pentru ob\u021binerea informa\u021biilor despre pachetele disponibile.\n<li class=\"l\"> Containerele \u201eadmin\u201d \u0219i \u201econtrol\u201d au fost actualizate.\n<li class=\"l\"> Versiunile pachetelor \u0219i dependen\u021belor pentru limbajele Go \u0219i Rust au fost actualizate.\n<li class=\"l\"> Versiunile pachetelor cu programe ter\u021be au fost actualizate.\n<li class=\"l\"> Problemele cu configura\u021bia tmpfilesd pentru kmod-5.10-nvidia au fost rezolvate.\n<li class=\"l\"> La instalarea tuftool, s-a asigurat legarea versiunilor dependen\u021belor.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56944\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.7.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u044f\u043c\u0438 MIT \u0438 Apache 2.0. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u043a Bottlerocket \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Amazon ECS, VMware \u0438 AWS EKS Kubernetes, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a \u0438 \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103663","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.7.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bottlerocket 1.7, \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.7.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-03-31T13:36:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-03-31T13:36:53+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Publica\u021bia Bottlerocket 1.7, distribu\u021bie bazat\u0103 pe containere izolate | ProHoster","description":"A fost publicat\u0103 versiunea 1.7.0 a distribu\u021biei Linux Bottlerocket, dezvoltat\u0103 cu participarea companiei Amazon pentru lansarea eficient\u0103 \u0219i sigur\u0103 a containerelor izolate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Bottlerocket 1.7, \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.7.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-bottlerocket-1-7-distributiva-na-baze-izolirovannyh-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-31T13:36:53+00:00","article:modified_time":"2022-03-31T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103663","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-31 13:38:02","updated":"2022-09-28 13:12:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103663"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103663\/revisions"}],"predecessor-version":[{"id":172979,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103663\/revisions\/172979"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}