The release of the new version of the Linux distribution "Bottlerocket 1.3.0" has been announced, in which some changes and improvements have been made to the system, the highlights of which are the added restrictions of MCS to the SELinux policy , as well as the solution to several SELinux policy problems, IPv6 support in kubelet and pluto and also hybrid boot support for x86_64.
For those unfamiliar with Bottlerocket, it's a Linux distribution developed in partnership with Amazon to run isolated containers efficiently and securely. This new version is primarily a package update, though it also includes some new features.
The distribution is characterized by providing an automatically and atomically updated indivisible system image that includes the Linux kernel and a minimal system environment that includes only the components necessary to run containers.
About Bottlerocket
The environment makes use of the systemd system manager, the Glibc library, Buildroot, the GRUB boot manager , the wicked network configurator, the containerd runtime for container isolation, the Kubernetes platform, AWS-iam-authenticator, and the Amazon ECS agent.
The container orchestration tools are shipped in a separate management container that is enabled by default and managed through the AWS SSM API and agent. The base image lacks a command shell, an SSH server, and interpreted languages ​​(for example, no Python or Perl): the administrator and debugging tools are moved to a separate services container, which is disabled by default.
The key difference compared to similar distributions like Fedora CoreOS, CentOS/Red Hat Atomic Host is the primary focus on providing maximum security in the context of strengthening the system against potential threats, making it harder to exploit vulnerabilities in operating system components and increasing container isolation.
Main new features of Bottlerocket 1.3.0
This new version of the distribution highlights the correction of vulnerabilities in the Docker Toolkit and Runtime Container (CVE-2021-41089, CVE-2021-41091, CVE-2021-41092, CVE-2021-41103) related to incorrect permission configuration, which allowed unprivileged users to leave the home directory and run external programs.
Among the changes implemented, we can find that IPv6 support has been added to kubelet and pluto , in addition to providing the ability to restart the container after changing its configuration, and adding support for Amazon EC2 M6i instances to eni-max-pods.
Also noteworthy are the new MCS restrictions on SELinux policy, as well as the resolution of several SELinux policy issues. Additionally, for the x86_64 platform, hybrid boot mode is implemented (with support for EFI and BIOS), and Open-vm-tools adds support for device filters based on the Cilium toolkit.
On the other hand, the compatibility with the version of the aws-k8s-1.17 distribution based on Kubernetes 1.17 was eliminated, which is why it is recommended to use the aws-k8s-1.21 variant with compatibility with Kubernetes 1.21, in addition to the k8s variants using the cgroup runtime.slice and system.slice settings.
Of the other changes that stand out in this new version:
- Region indicator added to aws-iam-authenticator command
- Restart modified host containers
- Updated the default control container to v0.5.2
- Eni-max-pods updated with new instance types
- Added new cilium device filters to open-vm-tools
- Include / var / log / kdumpen logdog tarballs
- Update third-party packages
- Wave definition added for slow implementation
- Added 'infrasys' to create TUF infra on AWS
- Archive old migrations
- Documentation changes
Finally, if you are interested in learning more , you can find the details at the following link.