Container-Optimized OS - Strengthening Container Host Security and Operations with Bottlerocket
Learn how to optimize container hosts with AWS Bottlerocket. Covers the minimal OS design, automatic updates, immutable infrastructure, and integration with ECS/EKS.
The Challenge of Container Host Operating Systems
When using EC2 instances as worker nodes for ECS or EKS, the choice of host OS has a significant impact on security and operations. General-purpose operating systems like Amazon Linux 2 or Ubuntu include many packages unnecessary for running containers (package managers, shells, various utilities), all of which expand the attack surface. OS patching also carries the risk of dependency issues when updating individual packages. Bottlerocket is a Linux-based OS purpose-built for containers, developed by AWS, that fundamentally solves these challenges. It includes only the container runtime (containerd), the Kubernetes kubelet (for EKS) or ECS agent, and minimal system components, thoroughly eliminating unnecessary software.
Security Design and Immutable Infrastructure
Bottlerocket's security design is multi-layered. The root filesystem is mounted read-only, and dm-verity verifies block-level integrity. If tampering is detected, the system refuses to boot. SELinux is enabled by default, restricting container process privileges to the minimum. Since there is no package manager, installing software at runtime is impossible, reducing supply chain attack risk. SSH access is disabled by default, and management is performed via API (through the SSM agent). OS updates use image-based atomic updates that replace the entire OS with a new image. Updates use an A/B partition scheme, and if booting from the new image fails, the system automatically rolls back to the previous version.
| Aspect | General-purpose OS | Bottlerocket |
|---|---|---|
| Bundled software | Package manager, shell and a long list of utilities | containerd plus kubelet or the ECS agent, and only the minimum system components |
| Root file system | Read-write | Read-only, verified by dm-verity; the system refuses to boot when tampering is detected |
| Installing software at runtime | Possible at any time through the package manager | Impossible - there is no package manager |
| Administrative access | Assumes SSH logins and hands-on changes | SSH is disabled by default; management goes through the API via the SSM agent |
| Mandatory access control | Depends on the distribution and configuration | SELinux is enabled by default |
| Unit of OS update | Per package, so dependency problems can appear | Atomic image-based update; A/B partitions roll back automatically if the new image fails to boot |
| Way in for troubleshooting | Log in to the host directly | Get temporary access from a dedicated container |
Integration with ECS/EKS and Operations
Bottlerocket provides AMIs compatible with both ECS and EKS. For EKS, you can use it simply by selecting Bottlerocket as the AMI type for managed node groups. Karpenter (node autoscaler) also supports specifying Bottlerocket AMIs. For ECS, you launch container instances using the ECS-optimized Bottlerocket AMI. Configuration is done via TOML-formatted user data, specifying Kubernetes cluster information or the ECS cluster name. The Bottlerocket Update Operator (for EKS) automates rolling updates that sequentially update nodes in the cluster. It automatically executes the cycle of draining a node (evicting Pods), updating, and rejoining, updating the OS without service interruption. Bottlerocket is free to use, and only EC2 instance charges apply.
Bottlerocket Pricing
Bottlerocket is free to use. Selecting the Bottlerocket AMI as the OS for your EC2 instances incurs only the same EC2 instance charges as Amazon Linux 2. There are no OS license fees. While Bottlerocket does not provide direct cost savings, the indirect cost benefits include reduced operational effort through automatic security patching and lower incident response costs through a reduced attack surface.
Summary - Guidelines for Using Bottlerocket
Bottlerocket is a minimal Linux OS optimized for container workloads. Its key strengths are the immutable filesystem, SELinux, dm-verity, atomic updates for high security, and native integration with ECS/EKS. If you are running EC2-based worker nodes on ECS or EKS, migrating from Amazon Linux 2 to Bottlerocket can strengthen security and simplify OS management. If you are using Fargate, host OS management is unnecessary, so Bottlerocket is not needed.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Bottlerocket official page
- Amazon EKS official page
- Amazon ECS official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.