AWS presented Bottlerocket, a new Linux distribution designed specifically to allow the execution of containers both in virtualized environments and directly on the hardware (bare metal). Bottlerocket differs from most Linux distributions by its different approach to updates and security.
AWS presents Bottlerocket: Linux for containers
Although there are several attempts to change the scenario of managing programs and libraries in the Linux world, such as Snap and Flatpak, the reference model remains that of packaging. Bottlerocket changes the cards on the table and proposes an upgrade model in which the whole system is upgraded in one step thanks to the fact that the system is based on images. This implies not only greater certainty that the update is successful without conflict, but also that it is can make a rollback effective changes without consequences. Among the advantages of this model we also find a greater one uptime and greater ease of management of updates on a large number of machines.
Bottlerocket is then almost exclusively read only, which increases its security level. DM-Verity is used, functionality of the Linux kernel that allows you to verify at boot time that the file system from which it is started has not been modified. Among the supported containers we find Docker and the images part of the Open Container Initiative.
Bottlerocket is currently available as a preview as an AMI (Amazon Machine Image) image to run on Amazon EC2. Further information and the project code are available on the dedicated GitHub page.