Bottlerocket Specialized2020年〜
A Linux-based open-source OS purpose-built for running containers
What It Does
Bottlerocket is a Linux-based operating system designed specifically as a container host OS. Unlike general-purpose Linux distributions, it includes only the minimal components needed to run containers, resulting in a smaller attack surface and faster boot times. OS updates are applied atomically (all at once), and failed updates are automatically rolled back.
Use Cases
Used as the worker node OS for EKS and ECS, serving as the execution platform for security-focused container workloads. It is adopted by financial institutions, healthcare organizations, and other environments with strict security requirements, as well as for simplifying OS management in large-scale microservices environments.
Everyday Analogy
Think of it like a work truck loaded with only specialized tools. If a general-purpose OS is a van packed with everything, Bottlerocket is a pickup truck carrying only the tools needed to run containers. With no unnecessary cargo, it runs lighter and faster, and there is less to steal, making it more secure.
What Is Bottlerocket?
Bottlerocket is a container-purpose Linux-based OS developed by AWS. General-purpose operating systems like Amazon Linux or Ubuntu include many components such as package managers and shell environments, but Bottlerocket consists of only a container runtime and minimal system components. SSH login is disabled by default, and configuration changes are made through an API. This design dramatically reduces the security attack surface.
Security and Updates
Bottlerocket's filesystem is mostly read-only, reducing the risk of OS file tampering at runtime. OS updates replace the entire image atomically rather than updating individual packages, preventing inconsistent states during updates. If an update fails, it automatically rolls back to the previous version. SELinux is also enabled, strengthening isolation between containers. For technical background on security and updates, reference books on Amazon are a useful resource.
Integration with EKS and ECS
Bottlerocket can be used as the worker node OS for both EKS and ECS. For EKS, simply select Bottlerocket as the AMI for your managed node group to get started. ECS also provides Bottlerocket-compatible AMIs. For troubleshooting, you can access nodes using AWS Systems Manager Session Manager. Bottlerocket is published as an open-source project on GitHub, and you can create custom builds.
Things to Watch Out For
- Bottlerocket itself is free and open-source, but standard EC2 instance charges apply for the instances it runs on
- Unlike general-purpose operating systems, there is no package manager, so you cannot install software directly on the OS. Everything runs as containers by design
- Since SSH is disabled by default, Systems Manager Session Manager is recommended for troubleshooting
