Live data from Hacker News

Bottlerocket, an open source Linux distribution built to run containers

aws.amazon.com

111–120 of 135 posts

Re: Bottlerocket, an open source Linux distribution built to run containers

#111

Earlier quoted context omitted.

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

> Bottlerocket is optimized for running containers with high security isolation. The host OS is extremely minimal, it does not come with bash, an interpreter, ssh, or anything beyond the system basics needed to run containers. In fact it uses an immutable root filesystem. You aren't intended to run or install things directly on the host at all.Bottlerocket is optimized for running containers with high security isolat…

Qubes is for end user desktop/laptop usage, not service hosting.

Re: Bottlerocket, an open source Linux distribution built to run containers

#112
post #111

Earlier quoted context omitted.

> Bottlerocket is optimized for running containers with high security isolation. The host OS is extremely minimal, it does not come with bash, an interpreter, ssh, or anything beyond the system basics needed to run containers. In fact it uses an immutable root filesystem. You aren't intended to run or install things directly on the host at all.Bottlerocket is optimized for running containers with high security isolat…

Qubes is for end user desktop/laptop usage, not service hosting.

Not yet for service hosting: https://www.qubes-os.org/news/2018/01/22/qubes-air/

Re: Bottlerocket, an open source Linux distribution built to run containers

#113

Earlier quoted context omitted.

As a former CoreOS (now Red Hat) employee, I'm glad to hear of your success with the product and it's awesome to see that scale giving you time back in your day to concentrate on the big picture.

Not at all happy with things right now. You guys abruptly killed CoreOS which was great and left us to fend for ourselves. Fedora CoreOS doesn’t cut it and we don’t want open shift. We will need to move to either bottle-rocket or flatcar. A team member evaluated both and we leaning towards b-rocket since flatcar has a higher risk of dying by running out of funding during COVID (seen this movie before with CoreOS). Am…

[deleted]

Re: Bottlerocket, an open source Linux distribution built to run containers

#114
post #103

Earlier quoted context omitted.

Yep, very much agree. Container Linux was still very young and growing, but had some great promise. Incorporating the tech into RHEL and Fedora was a great idea IMHO. I think CoreOS was acquired for that specific purpose personally.

Not sure. To me Flatcar brings the original CoreOS spirit..

I'm not able to find concrete examples of the differences between Flatcar and Fedora CoreOS aside from FCOS using rpm-ostree.

What are the differences especially regarding their spirit and philosophy?

Re: Bottlerocket, an open source Linux distribution built to run containers

#115
I haven't dug into the engineering behind this yet, but my main concern with any custom Linux distribution is it often ends up as a waste of engineering.

It's pretty easy to write your own Distro and pair it down to the essentials, and pairing it down that way allows you to strip out complexity, making it easier and more reliable to patch it. But that then means you are now maintaining this custom thing forever. If you're Amazon, that might be fine, but I suspect that this will be dropped when it is no longer profitable or a competing project supplants it - meaning in 5 years this thing might be gone. (A common theme of custom Linux distributions)

And then there's troubleshooting. With a stripped-down distro, you will eventually need more tools to debug the thing, meaning you have to build and maintain packages to do that. Bottlerocket's answer to this is "run them in containers and use our API!", but I'm not sold on this. Have you ever tried to do debugging between host and container, or container to container? There's a lot of b.s. you have to hop through, and most Unix tools were not written with it in mind. I highly doubt that it will magically work for everything. If that's the case, then this "don't worry, because magic" idea is not really saving you work over maintaining a traditional OS.

Moreover, you don't need a custom distro to do live patching. There are simple tricks you can use to juggle files and processes during a live patch, to say nothing of "checkpoint process && 'mv old_file new_file' && thaw process", etc. Kernels support live patching too. So if the argument is "well it's easier to patch", i'm not sure you're not trading away "easy" in one place for "pain in the ass" in another (see above). All of this also argues that it's just as effective to treat live-patched systems as you treat immutable infrastructure, and I'm not convinced of that argument either. The former is just more complex, and complexity attracts failures.

Ultimately I think what you'll find is Bottlerocket will get a niche following, but also some people will get annoyed by it and go back to regular distros which already have well defined methods.

Re: Bottlerocket, an open source Linux distribution built to run containers

#116
post #3

As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Sys…

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

Could bottlerocket be the basis for desktop system where it would be easy to switch between isolated environments? It would be very handy to have a maximally secure environment, at least from software perspective, for certain operations.

Re: Bottlerocket, an open source Linux distribution built to run containers

#117
post #30

Earlier quoted context omitted.

Why Bottlerocket? Why not just use Alpine, Void, NixOS, Arch, etc instead?

I've fallen in love with Alpine. I'm using it on my bare bone servers running from a ram disk (USB drive) hosting Docker containers and even qemu VMs. All on encrypted zfs volumes. Totally love it

Can you recommend any tutorials or blog posts on some of this? Really interested in it. Otherwise I'll search for it, thanks for the information.

Re: Bottlerocket, an open source Linux distribution built to run containers

#118
post #117
post #30

Earlier quoted context omitted.

I've fallen in love with Alpine. I'm using it on my bare bone servers running from a ram disk (USB drive) hosting Docker containers and even qemu VMs. All on encrypted zfs volumes. Totally love it

Can you recommend any tutorials or blog posts on some of this? Really interested in it. Otherwise I'll search for it, thanks for the information.

Here are some links for you that I think would be useful for a related setup, however I can't speak for the user that posted that. The headless installation should follow the same principles of using a RAMDisk though.

https://wiki.alpinelinux.org/wiki/Raspberry_Pi_-_Headless_In...

https://wiki.alpinelinux.org/wiki/Alpine_Linux_with_root_on_...

https://wiki.alpinelinux.org/wiki/Docker

https://wiki.alpinelinux.org/wiki/Install_Alpine_in_Qemu

Re: Bottlerocket, an open source Linux distribution built to run containers

#119

Earlier quoted context omitted.

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bo…

Could bottlerocket be the basis for desktop system where it would be easy to switch between isolated environments? It would be very handy to have a maximally secure environment, at least from software perspective, for certain operations.

You may want to look into Qubes. It's not specifically designed for running containers like this is, but it does provide a single OS with multiple isolated environments for different programs.

Re: Bottlerocket, an open source Linux distribution built to run containers

#120
post #110

Earlier quoted context omitted.

Did you even read the blog post? This is running Linux, and only the AWS software-components running on it are largely written in Rust. It is still Linux and the OS is not written in Rust, nor the container daemon and probably none of the non-AWS software packages.

Most available userspace seems to be a mix of Rust and Go, except for existing stuff written in C like LinuxSE.

What userspace do you see written in Rust?
Post reply on HN