\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Bottlerocket 1.1.0, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Amazon \u0434\u043b\u044f \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u044f\u043c\u0438 MIT \u0438 Apache 2.0. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0443\u0441\u043a Bottlerocket \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Amazon ECS \u0438 AWS EKS Kubernetes, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a \u0438 \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u0439, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043e\u0440\u043a\u0435\u0441\u0442\u0440\u043e\u0432\u043a\u0438 \u0438 runtime \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. <\/p>\n
Ky distribucion ofron nj\u00eb imazh sistemik t\u00eb pandar\u00eb dhe automatikisht t\u00eb p\u00ebrdit\u00ebsuar, q\u00eb p\u00ebrfshin b\u00ebrtham\u00ebn Linux dhe nj\u00eb mjedis minimal sistemi, duke p\u00ebrfshir\u00eb vet\u00ebm komponent\u00ebt e nevojsh\u00ebm p\u00ebr funksionimin e kontejner\u00ebve. N\u00eb mjedis p\u00ebrdoren menaxheri i sistemit systemd, biblioteka Glibc, instrumenti i nd\u00ebrtimit Buildroot, ngarkuesi GRUB, konfiguruesi i rrjetit wicked, runtime p\u00ebr kontejner\u00ebt e izoluar containerd, platforma e orkestrimit t\u00eb kontejner\u00ebve Kubernetes, autentifikuesi aws-iam-authenticator dhe agjenti Amazon ECS. <\/p>\n
Instrumentet p\u00ebr orkestrimin e kontejner\u00ebve ofrohen n\u00eb nj\u00eb kontejner menaxhues t\u00eb ve\u00e7ant\u00eb, i cili aktivizohet automatikisht dhe menaxhohet p\u00ebrmes API dhe AWS SSM Agent. N\u00eb imazhin baz\u00eb mungon shell-i komandues, server<\/a> SSH dhe gjuh\u00ebt e interpretuara (p\u00ebr shembull, jo Python ose Perl) \u2014 mjete p\u00ebr administratorin dhe instrumentet e debugging jan\u00eb nxjerr\u00eb n\u00eb nj\u00eb kontenier sh\u00ebrbimi t\u00eb ve\u00e7ant\u00eb, i cili \u00ebsht\u00eb i \u00e7aktivizuar nga parazgjedhja. <\/p>\n Dallimi kryesor nga distribucione t\u00eb ngjashme, t\u00eb tilla si Fedora CoreOS, CentOS\/Red Hat Atomic Host, \u00ebsht\u00eb orientimi fillestar p\u00ebr t\u00eb ofruar sigurin\u00eb maksimale n\u00eb kontekstin e forcimit t\u00eb mbrojtjes s\u00eb sistemit nga k\u00ebrc\u00ebnimet e mundshme, komplikuar p\u00ebrdorimin e dob\u00ebsive n\u00eb komponent\u00ebt e OS-s\u00eb dhe rritur izolimin e kontenier\u00ebve. Kontenier\u00ebt krijohen me mekanizmat standard\u00eb t\u00eb b\u00ebrtham\u00ebs Linux \u2014 cgroups, hap\u00ebsirat em\u00ebrtuese dhe seccomp. P\u00ebr izolim shtes\u00eb, n\u00eb distribucion p\u00ebrdooret SELinux n\u00eb m\u00ebnyr\u00ebn 'enforcing'. <\/p>\n Nj\u00eb pjes\u00eb e rr\u00ebnj\u00ebs montuar n\u00eb m\u00ebnyr\u00eb vet\u00ebm p\u00ebr lexim, dhe pjesa me konfigurimet \/etc montohet n\u00eb tmpfs dhe rikthen gjendjen origjinale pas rinisjes. Ndryshimi i drejtp\u00ebrdrejt\u00eb i skedareve n\u00eb katalogun \/etc, si \/etc\/resolv.conf dhe \/etc\/containerd\/config.toml, nuk mb\u00ebshtetet \u2014 p\u00ebr ruajtjen e p\u00ebrhershme t\u00eb konfigurimeve, duhet t\u00eb p\u00ebrdoret API ose t\u00eb nxirret funksionaliteti n\u00eb kontenier\u00eb t\u00eb ve\u00e7ant\u00eb. P\u00ebr verifikimin kriptografik t\u00eb integritetit t\u00eb pjes\u00ebs rr\u00ebnj\u00ebs p\u00ebrdoret moduli dm-verity, dhe n\u00eb rastin e zbules\u00ebs s\u00eb p\u00ebrpjekjeve p\u00ebr modifikimin e t\u00eb dh\u00ebnave n\u00eb nivelin e pajisjeve bllok, sistemi rindez. <\/p>\n Shumica e komponenteve sistemore jan\u00eb shkruar n\u00eb gjuh\u00ebn Rust, e cila ofron mjete p\u00ebr nj\u00eb funksionim t\u00eb sigurt t\u00eb memories, duke shmangur dob\u00ebsit\u00eb shkaktuar nga qasja n\u00eb hap\u00ebsir\u00ebn e memories pas lirimit t\u00eb saj, dereferencimin e treguesve t\u00eb nullit dhe teexit e kufijve t\u00eb buffers. Gjat\u00eb nd\u00ebrtimit, p\u00ebrdoren p\u00ebrve\u00e7 modeve t\u00eb kompilimit '\u2014enable-default-pie' dhe '\u2014enable-default-ssp' p\u00ebr aktivizimin e randomizimit t\u00eb hap\u00ebsir\u00ebs adresuese t\u00eb skedar\u00ebve ekzekutiv\u00eb (PIE) dhe mbrojtjes nga tejkalimi i stack-ut p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb etiketave kanar. P\u00ebr paketat e shkruara n\u00eb gjuh\u00ebn C\/C++, p\u00ebrve\u00e7 k\u00ebsaj, p\u00ebrfshihen edhe flagat '-Wall', '-Werror=format-security', '-Wp,-D_FORTIFY_SOURCE=2', '-Wp,-D_GLIBCXX_ASSERTIONS' dhe '-fstack-clash-protection'. <\/p>\n N\u00eb versionin e ri: <\/p>\n\n