Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bottlerocket, an open source Linux distribution built to run containers

aws.amazon.com

Post reply on HN
Print view View original

31–40 of 135 posts

Re: Bottlerocket, an open source Linux distribution built to run containers

#31

Post by mtndew4brkfst »

zokier wrote: post #21
coder543 wrote: post #6

Earlier quoted context omitted.

If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. There are a variety of options currently, including one from Amazon, but Bottlerocket seems designed to be a next-generation OS for container instances. It's extremely minimal, and designed to be as secure as possible, with transactional automatic updates. Ideally, I…

> If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. Forgetting Fargate there?

Like most of the rest of AWS product people and AWS users do, IME.

Re: Bottlerocket, an open source Linux distribution built to run containers

#32

Post by DyslexicAtheist »

while "Amazon drivers are hanging smartphones in trees to get more work"[0] and while "Amazon is Hiring an Intelligence Analyst to Track 'Labor Organizing Threats'" and while "Amazon deletes job listings for analysts to track ‘labor organizing threats’"[2] ... in this thread we are celebrating these lizards for their Tech innovation. What's more scary than the damage to society the employees hiding in these companies do, is the cognitive dissonance we experience here of highly skilled individuals (who should know better) telling themselves "technology is neutral".

[0] https://news.ycombinator.com/item?id=24342540

[1] https://news.ycombinator.com/item?id=24343361

[2] https://news.ycombinator.com/item?id=24345259

Re: Bottlerocket, an open source Linux distribution built to run containers

#33

Post by dpryden »

I'm confused about how the documentation recommends using a Kubernetes operator to manage OS updates. That seems weird and backwards to me. I would rather see an immutable OS AMI in an auto-scaled group, and just replace the node instance whenever there is an update.

I can see a place for managing OS updates on an instance, but that seems more like "pets" than "cattle"... and I've always treated Kubernetes nodes like cattle, not pets. Isn't that the most common approach anyway?

Re: Bottlerocket, an open source Linux distribution built to run containers

#34

Post by NathanKP »

e12e wrote: post #23
NathanKP wrote: post #12

Earlier quoted context omitted.

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

Would it be safe to say that bottlerocket is a container host for running containers under a hypervisor? Or is it intended to do full hw interfacing and run bare metal?

Bottlerocket runs containers using containerd, so containers are visible as processes on the host, from its perspective, not currently isolated from each other via a hypervisor. Bottlerocket limits containers ability to interact with the host or each other via SELinux, among other things.

We do have firecracker-containerd (https://github.com/firecracker-microvm/firecracker-container...) which is designed to allow the containerd runtime to launch containers as microVMs via Firecracker, with that additional layer of isolation via the KVM hypervisor. This stack is not currently fully compatible with K8s or ECS though, so it is not implemented using that approach yet. Rather Bottlerocket is built as a progressive improvement on the current state of container hosts, which is that many people are running all their containers on their hosts without any strong security hardening at all.

I think from the similar naming scheme of Firecracker and Bottlerocket you can already see the pieces of the puzzle that are in progress and the future potential though.

Re: Bottlerocket, an open source Linux distribution built to run containers

#35

Post by coder543 »

zokier wrote: post #21
coder543 wrote: post #6

Earlier quoted context omitted.

If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. There are a variety of options currently, including one from Amazon, but Bottlerocket seems designed to be a next-generation OS for container instances. It's extremely minimal, and designed to be as secure as possible, with transactional automatic updates. Ideally, I…

> If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. Forgetting Fargate there?

I literally mentioned Fargate in the same comment:

>> It would hopefully feel more similar to using Fargate than not, except without paying the higher price for Fargate, and having access to the wider variety of hardware configurations available to regular ECS.

If you're using an ECS Fargate Cluster or EKS Fargate Cluster, I don't consider those the same as an ECS Cluster or EKS Cluster. Unfortunately, there's no specific term commonly used for non-Fargate Clusters that I know of. AWS offers ECS Clusters and ECS Fargate Clusters.

If you were legitimately confused by my comment, I’m sorry. I could have said "non-Fargate" repeatedly, if it would have helped, but I thought the context made things clear, especially with the additional explicit mention of Fargate as a separate thing.

Re: Bottlerocket, an open source Linux distribution built to run containers

#36

Post by abhiyerra »

dpryden wrote: post #33

I'm confused about how the documentation recommends using a Kubernetes operator to manage OS updates. That seems weird and backwards to me. I would rather see an immutable OS AMI in an auto-scaled group, and just replace the node instance whenever there is an update. I can see a place for managing OS updates on an instance, but that seems more like "pets" than "cattle"... and I've always treated Kubernetes nodes like…

I agree with you. This seems more complex than just having a auto scale group that auto rotates nodes after a certain amount of time and just picking a new update when the node launches.

Re: Bottlerocket, an open source Linux distribution built to run containers

#37

Post by geoffeg »

azinman2 wrote: post #27
NathanKP wrote: post #12

Earlier quoted context omitted.

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

I just installed Proxmox on a home server, and I’m using its CT containers (LXC) to run various services. Could I use this as a replacement for Proxmox?

I read that this is more intended as the VM you run inside Proxmox, that you then run your (docker/k8) containers inside.

Re: Bottlerocket, an open source Linux distribution built to run containers

#38

Post by srameshc »

NathanKP wrote: post #12
solatic wrote: post #3

As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Sys…

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

Isn't it somewhat similar in concept to the Container-Optimized OS that is being offered by GCP ?

Re: Bottlerocket, an open source Linux distribution built to run containers

#39

Post by NathanKP »

abhiyerra wrote: post #36
dpryden wrote: post #33

I'm confused about how the documentation recommends using a Kubernetes operator to manage OS updates. That seems weird and backwards to me. I would rather see an immutable OS AMI in an auto-scaled group, and just replace the node instance whenever there is an update. I can see a place for managing OS updates on an instance, but that seems more like "pets" than "cattle"... and I've always treated Kubernetes nodes like…

I agree with you. This seems more complex than just having a auto scale group that auto rotates nodes after a certain amount of time and just picking a new update when the node launches.

I can provide a little background on this. In general yes I would recommend that you just use an ASG and roll out a new AMI. However that approach can be very expensive and time-consuming at truly massive scale (1000's or even 10's of thousands of machines).

Bottlerocket is built in part based on our experiences operating AWS Fargate, which obviously has as one of its needs the ability to patch a colossal number of hosts which are running people's containers, without downtime or disrupting their containers. Bottlerocket is designed to ensure that this is both efficient and safe. We aren't the only ones with this need. Many large orgs also have tremendous fleets, and its unacceptable to cause significant disruption by rotating at the host level.

Another aspect to consider is stateful workloads that are using the local disks. Bottlerocket lets you safely update your host if you are running something like a database or other stateful system where you don't really want to move your data around.

Not everyone will need to use this updating mechanism, but I think it will be very attractive to many of the larger organizations with a lot of infrastructure.

Re: Bottlerocket, an open source Linux distribution built to run containers

#40

Post by WrtCdEvrydy »

NathanKP wrote: post #12
solatic wrote: post #3

As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Sys…

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

Question: Will this be an AMI that can be deployed as an ECS cluster recipient on EC2? End Question.
Post reply on HN