bottlerocket

Bottlerocket OS is a free and open-source Linux-based operating system engineered by Amazon to host container workloads securely and reliably. Unlike traditional general-purpose Linux distributions, Bottlerocket minimizes its attack surface by removing unnecessary components like package managers and interactive shells from the default runtime environment. Its architecture prioritizes security, maintainability, and consistency. Key Features: - Immutable Filesystem: The root filesystem is read-only, preventing unauthorized or accidental modifications that could compromise stability. - API-Driven Configuration: System settings are managed via a local HTTP API rather than manual file edits. This allows for structured, validated configuration changes that are automatically migrated across updates. - Reliable Updates: Bottlerocket uses a dual-partition update mechanism (A/B partitions). It downloads full filesystem images secured by The Update Framework (TUF) and reboots into the new version. If boot fails, it automatically rolls back to the previous state. - Host Containers: Management tasks are isolated in separate containers (Control and Admin containers) running outside the main orchestrator, ensuring that management overhead does not impact workload performance. Supported Environments: Bottlerocket offers specific variants tailored for different container orchestrators and cloud platforms: - AWS EKS (Kubernetes): Variants like `aws-k8s-1.31` through `1.36`, including NVIDIA GPU-enabled versions. - AWS ECS: Variants such as `aws-ecs-2` and `aws-ecs-3`, supporting both standard and FIPS-compliant modes. - VMware: Kubernetes worker node variants (`vmware-k8s-*`). Access and Management: By default, SSH is disabled to enhance security. Administrators can access the system using: 1. Control Container: Uses AWS Systems Manager (SSM) Session Manager to execute commands and view logs without network exposure. 2. Admin Container: An optional container that provides SSH access for advanced debugging and root shell access via `sheltie`. Configuration is handled through the `apiclient` tool or by passing TOML/JSON settings during instance initialization. The system supports various settings including Kubernetes cluster integration, ECS agent configuration, network proxies, NTP, kernel parameters, and custom CA certificates. Community and Contribution: Bottlerocket encourages community participation through GitHub discussions and Meetup groups. Contributions are welcome via the contributor guide. Security issues should be reported directly to the security team rather than public issue trackers. Architectures: The OS supports x86_64 and ARM64 (aarch64) architectures, making it suitable for a wide range of hardware deployments within supported cloud providers.