Bottlerocket: An Early Look

Early evaluation of AWS Bottlerocket for container hosts, covering its security-focused operating model, update strategy, and operational tradeoffs. Helps teams decide when Bottlerocket is a fit for their cloud container platform.

Coveros Staff

September 15, 2020

With the popularity of containers and container-based architecture, it can be hard to keep up with new container technologies and pick out the useful ones from a sea of competition. It’s important to carefully consider technology choices lest one adopt technology they don’t really need for minimal gain, and fail to KISS.

Bottlerocket was released for public preview by Amazon Web Services (AWS) in early March 2020, and for general availability on August 31, 2020. Its purpose is to lower management overhead and costs and improve security, applying many of the principles behind Docker to the instances we run Docker atop of. It does this through locked-down access and bare-minimal software on instances running Bottlerocket, greatly reducing the attack surface.

Pros

  • No additional cost. Standard EC2 rates apply.
  • “Atomic updating.” Updates are applied in a single step, rather than by package, with the goal of reducing management overhead and making rollbacks easier.
  • Supports Open Container Initiative Image Format images.
  • Backed by Amazon. A huge company’s support improves Bottlerocket’s odds of not going the way of Container-optimized OS and Container Linux.
  • Open-source.

Cons

  • AWS ecosystem focused. Bottlerocket is built by Amazon, for use within AWS, although it should be compatible with and extensible to other cloud computing platforms.
  • No SSH, no shell. Access is intended to be through orchestration tools, e.g., EKS, not directly.
  • Requires containerized architecture, e.g., microservices running in a Kubernetes cluster.
  • Relatively new and immature.

Most of these cons, such as locked-down instance access and container focus, are by design, and not strictly disadvantageous. Given the lack of additional costs, if you’re already ingrained in the AWS ecosystem, there’s no reason not to give it a shot.

Want to learn more about AWS cloud skills and best practices? Explore our upcoming training classes, including AWS Technical Essentials, System Operations on AWS, Developing on AWS, and more.

Updates 1/20/21:

As a clarification to one of the cons, it’s possible to enable shell via an admin container, as detailed in a helpful comment from a representative of Amazon below.

Additionally, the first con was modified to remove any implication that Bottlerocket cannot work with other cloud computing platforms

Related Blogs

Navigating the Technical Debt Crisis in Financial Services

Leveraging AI-Augmented Development to Mitigate Systemic Risk and Reclaim Operational Alpha

Building Scalable Resilient and Efficient Systems with the GitHub Well Architected Framework

Breaks down the Architecture pillar of the GitHub Well-Architected Framework, covering scalability, resiliency, efficiency, modularity,...

Ensuring Control Compliance and Accountability with the GitHub Well Architected Framework

A deep dive into the Governance pillar of the GitHub Well-Architected Framework, covering auditability, accountability, adaptability, and...

Bolstering Your Defenses with the GitHub Well-Architected Framework

Breaks down the Application Security pillar of the GitHub Well-Architected Framework, linking principles, checklists, and implementation...
Coveros Staff

Coveros Staff

This post represents the collective insights of the Coveros team. Our staff consists of software experts who bring deep experience in secure agile development, DevOps, testing, and software quality. Over the past 20 years, Coveros has trained more than 30,000 professionals and worked with half of the Fortune 100 companies on mission-critical software development challenges. We draw on this extensive experience to share practical insights, proven strategies, and real-world solutions that help organizations build better software faster and more securely.