9 ms·

As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed

As strong as the engineering behind Bottlerocket seems to be, I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. If you, as an AWS customer, decide to fully embrace AWS lock-in, then why would you run this yourself on an EC2 instance instead of running ECS or EKS? If you're trying to avoid AWS lock-in, why would you choose an OS that's locking you into AWS Systems Manager and Amazon Linux 2 for debugging needs?

acdha 6y ago
There are varying levels of lock-in. A Linux distribution to run containers is a lot easier to replace than, say, a database with a proprietary query language custom semantics.
captn3m0 6y ago
>sure who they built it for Anytime AWS finds many of its customers using something outside of AWS, they want to build it in-house. AWS customers were using CoreOS a lot, hence this.
coder543 6y ago
If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. There are a variety of options currently, including one from Amazon, but Bottlerocket seems designed to be a next-generation OS for container instances. It's extremely minimal, and designed to be as secure as possible, with transactional automatic updates. Ideally, I would just deploy Bottlerocket as the underlying OS on my ECS Cluster, and then never have to actually do any management of the Instance OSes whatsoever. I would deploy containers on top of my ECS Cluster, Bottlerocket would keep itself up to date and secure, and my containers would live happily ever after. It would hopefully feel more similar to using Fargate than not, except without paying the higher price for Fargate, and having access to the wider variety of hardware configurations available to regular ECS. Amazon has specifically said this in the Bottlerocket repo: > Bottlerocket is architected such that different cloud environments and container orchestrators can be supported in the future. It's mainly useful in concert with ECS or EKS right now, but it is architected to be useful in other places as well. I'm excited about Bottlerocket as a project, and I'm glad it's open source instead of just an opaque AMI that you can use on ECS or EKS.
- solatic 6y ago
  > It's mainly useful in concert with ECS or EKS right now, but it is architected to be useful in other places as well. Right, this is the big question. If a community forms to support Bottlerocket off of AWS, then that's one thing, but until then, it basically just seems like a better option for ECS or EKS.
  - coder543 6y ago
    >>> I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. >> <snip> > If a community forms to support Bottlerocket off of AWS, then that's one thing, but until then, it basically just seems like a better option for ECS or EKS. I'm failing to see why that's a problem or a source of confusion. There's a clearly defined market of "who they built it for", and there's a community option to expand Bottlerocket's target market. The code is open source, so anyone could fork Bottlerocket and modify it to suit their needs immediately. Will Bottlerocket see success beyond ECS and EKS? Only time will tell... literally no one knows yet.
- zokier 6y ago
  > If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. Forgetting Fargate there?
  - mtndew4brkfst 6y ago
    Like most of the rest of AWS product people and AWS users do, IME.
  - coder543 6y ago
    I literally mentioned Fargate in the same comment: >> It would hopefully feel more similar to using Fargate than not, except without paying the higher price for Fargate, and having access to the wider variety of hardware configurations available to regular ECS. If you're using an ECS Fargate Cluster or EKS Fargate Cluster, I don't consider those the same as an ECS Cluster or EKS Cluster. Unfortunately, there's no specific term commonly used for non-Fargate Clusters that I know of. AWS offers ECS Clusters and ECS Fargate Clusters. If you were legitimately confused by my comment, I’m sorry. I could have said "non-Fargate" repeatedly, if it would have helped, but I thought the context made things clear, especially with the additional explicit mention of Fargate as a separate thing.
NathanKP 6y ago
Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bottlerocket is optimized for running containers with high security isolation. The host OS is extremely minimal, it does not come with bash, an interpreter, ssh, or anything beyond the system basics needed to run containers. In fact it uses an immutable root filesystem. You aren't intended to run or install things directly on the host at all. Everything that is installed and runs on Bottlerocket runs as containers, which are kept isolated from each other and the host with best practice security features such as SELinux. For example you can connect to a container on the host via AWS Systems Manager, or you can optionally enable a container that lets you connect to it via SSH. Once again the thing you are connecting to is the container on the host though, not directly to the host. For this initial release of Bottlerocket we are focusing on providing image variants that are prepackaged with the requirements to serve as underlying container hosts for an ECS or EKS cluster. However we also intend Bottlerocket to eventually be something that anyone can use, anywhere, even outside of AWS, if they wanted to benefit from the secure by default, container first design of Bottlerocket. You can read more about the security features of Bottlerocket here: https://github.com/bottlerocket-os/bottlerocket/blob/develop/SECURITY_FEATURES.md https://github.com/bottlerocket-os/bottlerocket/blob/develop... And you can find a bit more of the charter / goals for the project here: https://github.com/bottlerocket-os/bottlerocket/blob/develop/CHARTER.md https://github.com/bottlerocket-os/bottlerocket/blob/develop...
- mnd999 6y ago
  So you saw CoreOS and thought “Let’s re:invent that wheel”?
  - 013a 6y ago
    You mean, the CoreOS that was end-of-lifed four months ago?
deleted 6y ago
[deleted]

acdha 6y ago

There are varying levels of lock-in. A Linux distribution to run containers is a lot easier to replace than, say, a database with a proprietary query language custom semantics.

captn3m0 6y ago

>sure who they built it for Anytime AWS finds many of its customers using something outside of AWS, they want to build it in-house. AWS customers were using CoreOS a lot, hence this.

coder543 6y ago

If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. There are a variety of options currently, including one from Amazon, but Bottlerocket seems designed to be a next-generation OS for container instances. It's extremely minimal, and designed to be as secure as possible, with transactional automatic updates. Ideally, I would just deploy Bottlerocket as the underlying OS on my ECS Cluster, and then never have to actually do any management of the Instance OSes whatsoever. I would deploy containers on top of my ECS Cluster, Bottlerocket would keep itself up to date and secure, and my containers would live happily ever after. It would hopefully feel more similar to using Fargate than not, except without paying the higher price for Fargate, and having access to the wider variety of hardware configurations available to regular ECS. Amazon has specifically said this in the Bottlerocket repo: > Bottlerocket is architected such that different cloud environments and container orchestrators can be supported in the future. It's mainly useful in concert with ECS or EKS right now, but it is architected to be useful in other places as well. I'm excited about Bottlerocket as a project, and I'm glad it's open source instead of just an opaque AMI that you can use on ECS or EKS.

solatic 6y ago
> It's mainly useful in concert with ECS or EKS right now, but it is architected to be useful in other places as well. Right, this is the big question. If a community forms to support Bottlerocket off of AWS, then that's one thing, but until then, it basically just seems like a better option for ECS or EKS.
- coder543 6y ago
  >>> I'm not entirely sure who they built it for, except as a foundational component for AWS's managed offerings. >> <snip> > If a community forms to support Bottlerocket off of AWS, then that's one thing, but until then, it basically just seems like a better option for ECS or EKS. I'm failing to see why that's a problem or a source of confusion. There's a clearly defined market of "who they built it for", and there's a community option to expand Bottlerocket's target market. The code is open source, so anyone could fork Bottlerocket and modify it to suit their needs immediately. Will Bottlerocket see success beyond ECS and EKS? Only time will tell... literally no one knows yet.
zokier 6y ago
> If you're using an ECS or EKS Cluster, you still have to run some operating system on the ECS Container Instances. The containers have to run somewhere. Forgetting Fargate there?
- mtndew4brkfst 6y ago
  Like most of the rest of AWS product people and AWS users do, IME.
- coder543 6y ago
  I literally mentioned Fargate in the same comment: >> It would hopefully feel more similar to using Fargate than not, except without paying the higher price for Fargate, and having access to the wider variety of hardware configurations available to regular ECS. If you're using an ECS Fargate Cluster or EKS Fargate Cluster, I don't consider those the same as an ECS Cluster or EKS Cluster. Unfortunately, there's no specific term commonly used for non-Fargate Clusters that I know of. AWS offers ECS Clusters and ECS Fargate Clusters. If you were legitimately confused by my comment, I’m sorry. I could have said "non-Fargate" repeatedly, if it would have helped, but I thought the context made things clear, especially with the additional explicit mention of Fargate as a separate thing.

NathanKP 6y ago

Hi I'm a developer advocate in the container engineering org at AWS. I think there are a few misunderstandings here that I may be able to explain better. First Bottlerocket is not Amazon Linux 2, it is its own minimal operating system, with most components built from the ground up in Rust. This is totally different than the Amazon Linux 2 you may be familiar with (and most other operating systems for that matter). Bottlerocket is optimized for running containers with high security isolation. The host OS is extremely minimal, it does not come with bash, an interpreter, ssh, or anything beyond the system basics needed to run containers. In fact it uses an immutable root filesystem. You aren't intended to run or install things directly on the host at all. Everything that is installed and runs on Bottlerocket runs as containers, which are kept isolated from each other and the host with best practice security features such as SELinux. For example you can connect to a container on the host via AWS Systems Manager, or you can optionally enable a container that lets you connect to it via SSH. Once again the thing you are connecting to is the container on the host though, not directly to the host. For this initial release of Bottlerocket we are focusing on providing image variants that are prepackaged with the requirements to serve as underlying container hosts for an ECS or EKS cluster. However we also intend Bottlerocket to eventually be something that anyone can use, anywhere, even outside of AWS, if they wanted to benefit from the secure by default, container first design of Bottlerocket. You can read more about the security features of Bottlerocket here: https://github.com/bottlerocket-os/bottlerocket/blob/develop/SECURITY_FEATURES.md https://github.com/bottlerocket-os/bottlerocket/blob/develop... And you can find a bit more of the charter / goals for the project here: https://github.com/bottlerocket-os/bottlerocket/blob/develop/CHARTER.md https://github.com/bottlerocket-os/bottlerocket/blob/develop...

mnd999 6y ago
So you saw CoreOS and thought “Let’s re:invent that wheel”?
- 013a 6y ago
  You mean, the CoreOS that was end-of-lifed four months ago?

deleted 6y ago

[deleted]