Container-Optimized OS - Strengthening Container Host Security and Operations with Bottlerocket
Learn how to optimize container hosts with AWS Bottlerocket. Covers the minimal OS design, automatic updates, immutable infrastructure, and integration with ECS/EKS.
The Challenge of Container Host Operating Systems
When using EC2 instances as worker nodes for ECS or EKS, the choice of host OS has a significant impact on security and operations. General-purpose operating systems like Amazon Linux 2 or Ubuntu include many packages unnecessary for running containers (package managers, shells, various utilities), all of which expand the attack surface. OS patching also carries the risk of dependency issues when updating individual packages. Bottlerocket is a Linux-based OS purpose-built for containers, developed by AWS, that fundamentally solves these challenges. It includes only the container runtime (containerd), the Kubernetes kubelet (for EKS) or ECS agent, and minimal system components, thoroughly eliminating unnecessary software.
Security Design and Immutable Infrastructure
Bottlerocket's security design is multi-layered. The root filesystem is mounted read-only, and dm-verity verifies block-level integrity. If tampering is detected, the system refuses to boot. SELinux is enabled by default, restricting container process privileges to the minimum. Since there is no package manager, installing software at runtime is impossible, reducing supply chain attack risk. SSH access is disabled by default, and management is performed via API (through the SSM agent). OS updates use image-based atomic updates that replace the entire OS with a new image. Updates use an A/B partition scheme, and if booting from the new image fails, the system automatically rolls back to the previous version.
Integration with ECS/EKS and Operations
Bottlerocket provides AMIs compatible with both ECS and EKS. For EKS, you can use it simply by selecting Bottlerocket as the AMI type for managed node groups. Karpenter (node autoscaler) also supports specifying Bottlerocket AMIs. For ECS, you launch container instances using the ECS-optimized Bottlerocket AMI. Configuration is done via TOML-formatted user data, specifying Kubernetes cluster information or the ECS cluster name. The Bottlerocket Update Operator (for EKS) automates rolling updates that sequentially update nodes in the cluster. It automatically executes the cycle of draining a node (evicting Pods), updating, and rejoining, updating the OS without service interruption. Bottlerocket is free to use, and only EC2 instance charges apply. You can systematically learn Kubernetes operations from basics to advanced topics through books (Amazon).
Bottlerocket Pricing
Bottlerocket is free to use. Selecting the Bottlerocket AMI as the OS for your EC2 instances incurs only the same EC2 instance charges as Amazon Linux 2. There are no OS license fees. While Bottlerocket does not provide direct cost savings, the indirect cost benefits include reduced operational effort through automatic security patching and lower incident response costs through a reduced attack surface.
Summary - Guidelines for Using Bottlerocket
Bottlerocket is a minimal Linux OS optimized for container workloads. Its key strengths are the immutable filesystem, SELinux, dm-verity, atomic updates for high security, and native integration with ECS/EKS. If you are running EC2-based worker nodes on ECS or EKS, migrating from Amazon Linux 2 to Bottlerocket can strengthen security and simplify OS management. If you are using Fargate, host OS management is unnecessary, so Bottlerocket is not needed.