Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bottlerocket, an open source Linux distribution built to run containers

aws.amazon.com

Post reply on HN
Print view View original

71–80 of 135 posts

Re: Bottlerocket, an open source Linux distribution built to run containers

#71

Post by jhaynes »

e12e wrote: post #46
NathanKP wrote: post #34

Earlier quoted context omitted.

Bottlerocket runs containers using containerd, so containers are visible as processes on the host, from its perspective, not currently isolated from each other via a hypervisor. Bottlerocket limits containers ability to interact with the host or each other via SELinux, among other things. We do have firecracker-containerd ( https://github.com/firecracker-microvm/firecracker-container... ) which is designed to allow t…

Thanks, I was more wondering what the relationship was between something like Debian GNU/linux and bottlerocket. From gp description it sounds like there's no "GNU userland", just the Linux kernel and some utility functions in rust - enough to launch containerd. So if I have a heterogeneous collection of servers - I could install Debian, and run docker on Debian. It sounds like bottlerocket would more comfortably run…

Answering your initial question and this one: Bottlerocket today only runs in EC2, but we've tried to make it flexible enough to run outside of a hypervisor on bare metal in the future (in fact, a few engineers on the team are really excited to get it running on their RaspberryPi's at home; toasters haven't been added to our roadmap yet ;) ).

Bottlerocket has a GNU userland like many other distros. It is just one that is stripped down of many things including removal of interpreters, shells, and package managers.

If you want to explore more deeply, you can enable the admin container and jump into a shell on the host[1] to look at the filesystem and see what Bottlerocket's userspace looks like up close and personal. You can also see a bit more of this debugging/exploration tooling explained in an AWS Partner Blog[2].

[1] https://github.com/bottlerocket-os/bottlerocket#admin-contai... [2] https://aws.amazon.com/blogs/apn/getting-started-with-bottle...

Re: Bottlerocket, an open source Linux distribution built to run containers

#72

Post by wmf »

dan_quixote wrote: post #63
freedomben wrote: post #45

Earlier quoted context omitted.

This is how OpenShift 4 does things. I too thought it was strange at first but now with some experience it's quite pleasant. Can be a beast to debug though if you haven't done it before.

I can assure you that OpenShift doesn't take this path because it is "better". It does so because bare-metal is a significant part of their market and there isn't a better option to automate the process currently. I once worked on a competing product (before the OS update operator was available) and the update-in-place model was always a disaster. Various problems like dns, service discovery, timeouts, breaking chang…

Was that with a 1990s mutable package-based distro by any chance?

Re: Bottlerocket, an open source Linux distribution built to run containers

#73

Post by kapilvt »

trishankdatadog wrote: post #59

Little-known fact: like Google Fuchsia, Bottlerocket uses The Update Framework (TUF)[1][2] to securely update itself! [1] https://theupdateframework.io/ [2] https://github.com/awslabs/tough

tough is one of the actual oss gems behind bottle rocket thats reusable in non aws contexts.. bottle rocket probably can be but likely that will always be a second class citizen, and afaics completely undocumented for usage outside of aws atm.

Re: Bottlerocket, an open source Linux distribution built to run containers

#74

Post by kapilvt »

daxfohl wrote: post #16

So difference between this and Firecracker would be that the latter is boot-speed and overhead optimized, and this one is a bit heavier but more capable? If choosing between this and say Kata Containers plus Firecracker, the latter would be more secure because of VM isolation but this would be more efficient because multiple pods could go in a single VM? Is Bottlerocket secure enough to host multi-tenant workloads wi…

multi-tenant workloads in the same vm.. thats sort of depends on your definition of 'secure', generally speaking for most enterprises the answer is no, the linux kernel is a huge surface attack space, firecracker and gvisor are different approaches at mitigating that. firecracker via a minimal hypervisor with legacy qemu stripped and a minimal exposed sys call/hypercall interface.. gvisor via reimplementing sys calls in golang intermediaries. both have tradeoffs, but my two cents would be around firecracker since its able to use more upstream kernel.

Re: Bottlerocket, an open source Linux distribution built to run containers

#75

Post by rubyn00bie »

azinman2 wrote: post #27
NathanKP wrote: post #12

Earlier quoted context omitted.

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

I just installed Proxmox on a home server, and I’m using its CT containers (LXC) to run various services. Could I use this as a replacement for Proxmox?

Nope. Proxmox is mostly just an administrative UI, containers are a Linux feature. You don't need Proxmox for anything, you can just run containers "natively" in Linux or VMs with KVM + QEMU. The linked above is mostly just a Linux distro geared towards a pretty specific set of use-cases.

Re: Bottlerocket, an open source Linux distribution built to run containers

#76

Post by b-rian »

adolph wrote: post #20

Firecracker, Bottlerocket, starting to see a trend here https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir...

You mean, this trend?

https://www.linuxha.com/bottlerocket/

https://www.linuxha.com/bottlerocket/#firecracker_info

Re: Bottlerocket, an open source Linux distribution built to run containers

#77

Post by jhaynes »

kapilvt wrote: post #73
trishankdatadog wrote: post #59

Little-known fact: like Google Fuchsia, Bottlerocket uses The Update Framework (TUF)[1][2] to securely update itself! [1] https://theupdateframework.io/ [2] https://github.com/awslabs/tough

tough is one of the actual oss gems behind bottle rocket thats reusable in non aws contexts.. bottle rocket probably can be but likely that will always be a second class citizen, and afaics completely undocumented for usage outside of aws atm.

Really glad you like our tough (TUF) library!

As far as running in non-AWS contexts, we haven't had time to head down that path yet, but as I mentioned in an earlier post, we've tried to build Bottlerocket in a way that it can be extended to work outside of AWS either as VMs or even bare metal. In fact, a few of the engineers on the team have been playing with getting it running on their RaspberryPi's at home :)

Re: Bottlerocket, an open source Linux distribution built to run containers

#78

Post by djeiasbsbo »

senthilnayagam wrote: post #8

I remember reading last week linux plumber conference agreed to allow rust in linux kernel . but these guys have built an OS in rust.

Well, they use a linux kernel which is written in C and some assembly. All of the overlying components are apparently written in rust. These components still interact with the system calls exposed by the kernel.

An example of a kernel itself written in rust would be the Redox microkernel. It seems to be able to run a graphical environment but it hasn't been updated in a while.

Re: Bottlerocket, an open source Linux distribution built to run containers

#80

Post by robomaker2 »

At my previous company we discarded the AWS-Linux distro and used rancherOS for container hosting because the version of yum they used was too flaky. They were unwilling to move to DNF to try and fix it. We've long badgered them for something like this (rancher style AWS-Linux dsitro) and they seem to have finally listened. Too bad, I moved to a different company and a different role to benefit from this. At least my old colleagues will be happy
Post reply on HN