bottlerocket-os/bottlerocket

Features

• Container Host Operating Systems - Provides a minimal and secure Linux distribution specifically optimized for hosting container workloads.
• Container-Optimized Operating Systems - Implements a secure, minimal Linux distribution specifically optimized to run and manage container workloads.
• Immutable Infrastructure OS - Provides an operating system using read-only filesystems and atomic partition swapping to ensure consistent and reversible infrastructure updates.
• Container-Optimized Operating Systems - Ships a minimal, security-focused Linux distribution optimized specifically for executing containerized applications.
• Immutable Root Filesystems - Protects the core system using signed read-only images to ensure filesystem integrity.
• Node Software Provisioning - Automates the installation of required runtimes and daemons to bootstrap operating system instances as orchestration nodes.
• API-Driven Infrastructure Managers - Replaces traditional shell access with a local REST API for managing host and cluster configurations.
• OS Management APIs - Updates and retrieves system configurations via a REST API to modify host behavior.
• Application Settings Management - Updates system configurations and administrative settings through a dedicated application programming interface.
• Container Hosting - Provides a secure, minimal Linux environment specifically optimized for hosting containerized workloads across orchestrators.
• Administrative Containers - Provides privileged host containers for administrative tasks and system debugging on an immutable OS.
• Container Shell Access - Provides a restricted administrative container with SSH access for system inspection and root-level tasks.
• Out-of-Band Host Access - Provides isolated containers with varying privilege levels for debugging and configuration on shell-less hosts.
• Container Execution - Runs container engines and orchestrators on a hardened Linux foundation to execute isolated applications.
• Container Orchestration Integrations - Connects to various container orchestration control planes via agents to automate the container lifecycle.
• OS Image Variants - Provides specialized OS builds tailored for specific cloud environments and hardware accelerators like GPUs.
• Kubernetes Cluster Management - Supports multiple versions of Kubernetes to function as a secure and stable cluster node.
• Kubernetes Cluster Provisioning - Integrates multiple kubelet versions to serve as a secure, production-grade Kubernetes cluster node.
• Kubernetes Integrations - Configures the kubelet and node settings to allow the system to join a Kubernetes cluster.
• Kubernetes Node Provisioning - Configures and manages secure cluster nodes that integrate with the kubelet to support Kubernetes clusters.
• Privileged Host Management - Runs privileged containers independently of the orchestrator to operate the system when agents fail.
• Atomic System Updates - Implements update mechanisms that replace the entire filesystem with a new signed image as a single indivisible operation.
• Immutable Operating Systems - Functions as an immutable operating system using signed read-only images and atomic partition swapping.
• Isolated Runtime Environments - Employs a dual-runtime isolation model that separates workload runtimes from system operational tasks.
• Kubernetes Node Images - Ships specialized system images optimized to function as secure, minimal nodes within Kubernetes clusters.
• OS Version Updates - Supports in-place updates to newer operating system versions while preserving the current variant configuration.
• Root Filesystem Integrity - Protects the system against unauthorized changes using integrity checks to maintain a signed, immutable root image.
• Read-Only Filesystem Enforcement - Employs signed root filesystems and integrity checking to prevent unauthorized modifications to the system.
• Boot Partition Swaps - Ensures consistent and reversible system updates by switching between bootable partitions.
• Administrative APIs - Manages host configurations and administrative tasks through a local REST API instead of shell-based files.
• System Configuration - Modifies operating system parameters via an API to update behavior without rebooting.
• API-Driven System Administration - Provides a local REST API to replace traditional shell-based configuration for administrative tasks like rebooting and update checks.
• Host Configuration Management - Modifies system settings using a local API server, command-line client, or user data.
• Host System Debugging - Provides out-of-band access to the host operating system via privileged containers for system modification and debugging.
• System Configuration Management - Modifies and retrieves operating system configurations through a centralized API interface.
• GPU Acceleration - Leverages pre-configured NVIDIA drivers to execute high-performance processing tasks on GPU-equipped instances.
• Neural Accelerators - Configures the necessary packages and drivers to run machine learning workloads on specialized AWS Neuron hardware.
• Host Environment Initialization - Provides the ability to execute specialized containers during boot to prepare the host environment for container workloads.
• System Software Updates - Provides mechanisms for replacing core system files and software with newer versions without full re-provisioning.
• Container Command Executors - Runs shell sessions and management commands on instances using an integrated control container.
• AWS ECS Deployments - Integrates with Amazon ECS to manage cluster membership and orchestration through the service agent.
• Container Orchestration & Deployment - Bootstraps a secure environment for deploying and scaling container orchestration services.
• Hardware-Accelerated OS Images - Ships pre-configured OS images with drivers for NVIDIA GPUs and neural accelerators to power high-performance workloads.
• Container Management Agent Deployments - Manages the deployment and execution of the ECS service agent for orchestration integration.
• OS Platform Variants - Provides specialized operating system builds tailored for different cloud providers, orchestrators, and hardware accelerators.
• ECS Node Management - Provides purpose-built nodes that integrate with the Amazon ECS agent to launch containerized workloads.
• Workload Isolation - Employs a dual-runtime isolation model to separate system operational tasks from customer workloads.
• Ephemeral Storage - Uses non-persistent storage for volatile system settings to ensure a clean state after reboot.
• Hardware-Specific Container Images - Provides pre-defined images tailored for specific architectures and hardware accelerators like NVIDIA GPUs.
• In-Place Node Updates - Enables applying software updates directly to running nodes to transition versions without full node replacement.
• In-Place OS Upgrades - Supports upgrading the operating system to a newer version on running hosts without requiring full re-provisioning.
• In-Place System Updates - Enables triggering system updates on existing nodes via an API server to avoid full reprovisioning.
• Administrative Host Access - Provides root access to the host operating system via a privileged administrative container for troubleshooting.
• OS Version Pinning - Allows administrators to lock the system to a specific release version to prevent automatic updates.
• Pre-built Image Deployments - Offers pre-configured image variants tailored for specific hosting environments to speed up deployment.
• Atomic OS Rollbacks - Provides the ability to revert the operating system to a previous known-good version after boot or workload failures.
• Dual-Runtime Isolations - Separates system operational runtimes from workload runtimes to prevent resource exhaustion.
• Hardware Acceleration - Integrates specialized drivers for NVIDIA GPUs and AWS Neuron instances to accelerate computational workloads.
• Hardware-Optimized OS Images - Provides pre-configured system images containing drivers and tools optimized for specific hardware and cloud platforms.
• Kernel Parameter Tuning - Provides the ability to modify Linux kernel parameters to optimize performance and behavior for container workloads.
• Bootstrap Configurations - Applies a collection of system settings at boot via TOML-formatted configuration.
• System Bootstrapping Configurations - Initializes system settings at boot using a TOML-formatted data file.
• Access Control Labels - Uses security labels and mandatory access control policies to apply granular read and write permissions to files.
• Mandatory Access Control - Restricts access to non-root filesystem resources using labels and mandatory access control policies.
• Container Privilege Restrictions - Applies enforced security policies to block containers from executing dangerous kernel-level operations.
• Initial Boot Configurations - Runs specialized containers during the boot process to initialize system settings before orchestrator connection.
• TOML-Based Synchronization - Initializes system state and environment settings at boot using structured TOML data files.
• Administrative - Runs debugging and administrative tools in separate privileged containers to maintain host security.
• Operational Task Automation - Performs system operations like rebooting and checking for updates via API calls.
• Remote Command Execution - Executes administrative commands and shell sessions on instances via a dedicated control container.
• Cluster Version Updaters - Provides utilities to refresh the cluster by provisioning new nodes with updated versions via centralized configuration.
• Node Replacement Updates - Supports updating clusters by provisioning new nodes and decommissioning old ones to ensure a clean state.
• Rolling Node Updates - Supports sequentially replacing nodes in a group with updated versions to apply system updates without service outages.

Star history