bottlerocket

Bottlerocket OS Welcome to Bottlerocket! Bottlerocket is a free and open-source Linux-based operating system meant for hosting containers. To learn more about Bottlerocket, visit the official Bottlerocket website and documentation. Otherwise, if you’re ready to jump right in, read one of our setup guides for running Bottlerocket in Amazon EKS, Amazon ECS, or VMware. If you're interested in running Bottlerocket on bare metal servers, please refer to the provisioning guide to get started. Bottlerocket focuses on security and maintainability, providing a reliable, consistent, and safe platform for container-based workloads. This is a reflection of what we've learned building operating systems and services at Amazon. You can read more about what drives us in our charter. The base operating system has just what you need to run containers reliably, and is built with standard open-source components. Bottlerocket-specific additions focus on reliable updates and on the API. Instead of making configuration changes manually, you can change settings with an API call, and these changes are automatically migrated through updates. Some notable features include: API access for configuring your system, with secure out-of-band access methods when you need them. Updates based on partition flips, for fast and reliable system updates. Modeled configuration that's automatically migrated through updates. Security as a top priority. Participate in the Community There are many ways to take part in the Bottlerocket community: Join us on Meetup to hear about the latest Bottlerocket (virtual/in-person) events and community meetings. Community meetings are typically every other week. Details can be found under the Events section on Meetup, and you will receive email notifications if you become a member of the Meetup group. (It's free to join!) Start or join a discussion if you have questions about Bottlerocket. If you're interested in contributing, thank you! Please see our contributor's guide. Contact us If you find a security issue, please contact our security team rather than opening an issue. We use GitHub issues to track other bug reports and feature requests. You can look at existing issues to see whether your concern is already known. If not, you can select from a few templates and get some guidance on the type of information that would be most helpful. Contact us with a new issue here. We don't have other communication channels set up quite yet, but don't worry about making an issue or a discussion thread! You can let us know about things that seem difficult, or even ways you might like to help. Variants To start, we're focusing on the use of Bottlerocket as a host OS in AWS EKS Kubernetes clusters and Amazon ECS clusters. We’re excited to get early feedback and to continue working on more use cases! Bottlerocket is architected such that different cloud environments and container orchestrators can be supported in the future. A build of Bottlerocket that supports different features or integration characteristics is known as a 'variant'. The artifacts of a build will include the architecture and variant name. For example, an x86_64 build of the aws-k8s-1.32 variant will produce an image named bottlerocket-aws-k8s-1.32-x86_64-<version>-<commit>.img. The following variants support EKS, as described above: aws-k8s-1.31 aws-k8s-1.32 aws-k8s-1.33 aws-k8s-1.34 aws-k8s-1.35 aws-k8s-1.36 aws-k8s-1.37 aws-k8s-1.31-nvidia aws-k8s-1.32-nvidia aws-k8s-1.33-nvidia aws-k8s-1.34-nvidia aws-k8s-1.35-nvidia aws-k8s-1.36-nvidia aws-k8s-1.37-nvidia The following variants support ECS: aws-ecs-2 aws-ecs-2-nvidia aws-ecs-3 aws-ecs-3-fips aws-ecs-3-nvidia We also have variants that are designed to be Kubernetes worker nodes in VMware: vmware-k8s-1.31 vmware-k8s-1.32 vmware-k8s-1.33 vmware-k8s-1.34 vmware-k8s-1.35 vmware-k8s-1.36 vmware-k8s-1.37 The following variants are no longer supported: All Kubernetes variants using Kubernetes 1.30 and earlier VMware variants using Kubernetes 1.30 and earlier Bare metal variants for Kubernetes ECS-1 variants We recommend users replace nodes running these variants with the latest variant compatible with their cluster. Architectures Our supported architectures include x86_64 and aarch64 (written as arm64 in some contexts). Setup 🚶 🏃 Bottlerocket is best used with a container orchestrator. To get started with Kubernetes in Amazon EKS, please see QUICKSTART-EKS. To get started with Kubernetes in VMware, please see QUICKSTART-VMWARE. To get started with Amazon ECS, please see QUICKSTART-ECS. These guides describe: how to set up a cluster with the orchestrator, so your Bottlerocket instance can run containers how to launch a Bottlerocket instance in EC2 or VMware To see how to provision Bottlerocket on bare metal, see PROVISIONING-METAL. To build your own Bottlerocket images, please see BUILDING. It describes: how to build an image how to register an EC2 AMI from an image To publish your built Bottlerocket images, please see PUBLISHING. It describes: how to make TUF repos including your image how to copy your AMI across regions how to mark your AMIs public or grant access to specific accounts how to make your AMIs discoverable using SSM parameters Exploration To improve security, there's no SSH server in a Bottlerocket image, and not even a shell. Don't panic! There are a couple out-of-band access methods you can use to explore Bottlerocket like you would a typical Linux system. Either option will give you a shell within Bottlerocket. From there, you can change settings, manually update Bottlerocket, debug problems, and generally explore. Note: These methods require that your instance has permission to access the ECR repository where these containers live; the appropriate policy to add to your instance's IAM role is AmazonEC2ContainerRegistryReadOnly. Control container Bottlerocket has a "control" container, enabled by default, that runs outside of the orchestrator in a separa