Wasn't Amazon Linux 2 something similar? Or I'm mixing it up https://aws.amazon.com/amazon-linux-2/
Seems like a similar goal, but the difference is that Bottlerocket is targeted at containers and Amazon Linux is targeted at EC2.
Bottlerocket, an open source Linux distribution built to run containers
11–20 of 135 posts
Re: Bottlerocket, an open source Linux distribution built to run containers
#12As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Sys…
Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better.
First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bottlerocket is optimized for running containers with high security isolation. The host OS is extremely minimal, it does not come with bash, an interpreter, ssh, or anything beyond the system basics needed to run containers. In fact it uses an immutable root filesystem. You aren't intended to run or install things directly on the host at all.
Everything that is installed and runs on Bottlerocket runs as containers, which are kept isolated from each other and the host with best practice security features such as SELinux. For example you can connect to a container on the host via AWS Systems Manager, or you can optionally enable a container that lets you connect to it via SSH. Once again the thing you are connecting to is the container on the host though, not directly to the host.
For this initial release of Bottlerocket we are focusing on providing image variants that are prepackaged with the requirements to serve as underlying container hosts for an ECS or EKS cluster. However we also intend Bottlerocket to eventually be something that anyone can use, anywhere, even outside of AWS, if they wanted to benefit from the secure by default, container first design of Bottlerocket.
You can read more about the security features of Bottlerocket here: https://github.com/bottlerocket-os/bottlerocket/blob/develop...
And you can find a bit more of the charter / goals for the project here: https://github.com/bottlerocket-os/bottlerocket/blob/develop...
Re: Bottlerocket, an open source Linux distribution built to run containers
#13Wasn't Amazon Linux 2 something similar? Or I'm mixing it up https://aws.amazon.com/amazon-linux-2/
Amazon Linux 2 is an AWS-optimized Linux distribution but it's a full distribution you're used to — RPM-based, generally compatible with RHEL/Centos, etc. — and that has the usual benefits and costs. You can customize it as much as any other Linux distribution but you're taking on the corresponding level of effort to secure and operate it. If all you run are containers, that's overhead for things you're not really using and it also means that you're going to be slower to update things like the kernel and system libraries since there's more to test and backwards compatibility is a big concern.
Re: Bottlerocket, an open source Linux distribution built to run containers
#14As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Sys…
Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…
So you saw CoreOS and thought “Let’s re:invent that wheel”?
Re: Bottlerocket, an open source Linux distribution built to run containers
#15I remember reading last week linux plumber conference agreed to allow rust in linux kernel . but these guys have built an OS in rust.
Did you even read the blog post? This is running Linux, and only the AWS software-components running on it are largely written in Rust. It is still Linux and the OS is not written in Rust, nor the container daemon and probably none of the non-AWS software packages.
Re: Bottlerocket, an open source Linux distribution built to run containers
#16So difference between this and Firecracker would be that the latter is boot-speed and overhead optimized, and this one is a bit heavier but more capable?
If choosing between this and say Kata Containers plus Firecracker, the latter would be more secure because of VM isolation but this would be more efficient because multiple pods could go in a single VM?
Is Bottlerocket secure enough to host multi-tenant workloads within the same VM?
Re: Bottlerocket, an open source Linux distribution built to run containers
#17Earlier quoted context omitted.
Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…
So you saw CoreOS and thought “Let’s re:invent that wheel”?
You mean, the CoreOS that was end-of-lifed four months ago?
Re: Bottlerocket, an open source Linux distribution built to run containers
#18Look out Rancher!
Rancher has been around a long time and isn't cloud-specific. Until this distro can prove itself useful outside of the AWS ecosystem, then Rancher will still dominate.
Re: Bottlerocket, an open source Linux distribution built to run containers
#19So difference between this and Firecracker would be that the latter is boot-speed and overhead optimized, and this one is a bit heavier but more capable? If choosing between this and say Kata Containers plus Firecracker, the latter would be more secure because of VM isolation but this would be more efficient because multiple pods could go in a single VM? Is Bottlerocket secure enough to host multi-tenant workloads wi…
Firecracker and Kata containers are ways to run containers inside lightweight VMs that boot directly into the Kernel, they are not Linux distros in themselves. You are trying to compare apples to oranges. You could run Firecracker or Kata containers on top of something like Bottlerocket, however Bottlerocket is geared more towards the container-sandbox and isolation crowd while Kata/Firecracker is for those who think you can only get isolation using VMs.
Re: Bottlerocket, an open source Linux distribution built to run containers
#20Firecracker, Bottlerocket, starting to see a trend here
https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir...