12 ms·

Amazon Linux 2022

270 points by gtirloni 5y ago

saurik 5y ago
Why do people choose Amazon Linux over, say, an Ubuntu LTS?
- shaicoleman 5y ago
  While I prefer Ubuntu myself, we use Amazon Linux because: * It has support for all new instances/hardware/services on day 1 * It's optimised for AWS, sometimes a bit faster than Ubuntu * It has a good balance of freshness, stability and long term support * It comes with integrations to all of AWS services and ecosystem * It's the default choice, and often the least hassle * It's fully supported by AWS * It's the only realistic choice for some services (e.g. Lambda, Elastic Beanstalk)
  - Jeff_Brown 5y ago
    > a good balance of freshness ... I'm surprised to read that. Coming from Ubuntu and in the last couple years NixOS I've found the Yum repos for Amazon Linux woefully stale.
    - shaicoleman 5y ago
      AL2 comes with amazon-linux-extras. It provides newer versions for a few key packages, e.g.: Docker 20.10, PostgreSQL 13, Ruby 3.0, Kernel 5.10, nginx 1.20, PHP 8.0, Python 3.8, Redis 6.2, Go 1.15, Rust 1.47, etc. Some newer packages, e.g. OpenSSL 1.1.1 and zsh 5.7 are provided in the main repo. Outdated packages wasn't a major pain point in my experience. The bigger issue is a relative small selection of packages. These are either available via 3rd party repos (e.g. NodeJS) or EPEL (e.g. libsodium), or by recompiling Fedora SRPMS. That can be an inconvenience, but not a big deal overall. I hope the situation will improve once AL2022 is out, as Fedora comes with a much wider selection of packages.
- throwdbaaway 5y ago
  On AWS, there are serious issues such as https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1331150/ https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1331150..., that only requires a simple sysctl workaround, yet AWS would only put the workaround into the Amazon Linux images. Meanwhile, the same issue was actually fixed once and for all on GCP: https://news.ycombinator.com/item?id=8732356 https://news.ycombinator.com/item?id=8732356
- whalesalad 5y ago
  There are really two primary camps - RedHat based (CentOS, Rocky Linux, Amazon Linux, etc) and Debian based (Debian, Ubuntu, etc). There are of course many other bloodlines - but these are the most common in production environments and more specifically cloud env. If you are familiar with one version of linux that is RH based, you will tend to gravitate to others with similar DNA. Likewise, if you come from Debian/Ubuntu you will tend to stick with those. At the end of the day they are both Linux, but each has their own approach to configuration, where things go, package management, etc. You really can't go wrong with either - use what you prefer.
  - saurik 5y ago
    FWIW, the real brunt of my question was why one would go with a cloud-provider specific operating system over one from a group like Canonical or RedHat, as I would naively expect it to have less support and particularly less ecosystem-wide understanding and experience while not being available for other systems, and so it would seem like an easily-avoidable source of vendor lock-in. If I were be part of Camp RedHat I would personally use CentOS, not "Amazon Linux", unless there was some extremely good reason why Amazon Linux in specific was awesome.
    - rob-olmos 5y ago
      Besides going the path of least resistance in AWS, possibly to get OS & package support from AWS if there's already an enterprise-level support plan in place, rather than needing to buy other support subscriptions (eg, RHEL)? AM2 is able to run in other places so there doesn't seem to be much vendor lock-in compared to a service like DynamoDB, though.
    - herodoturtle 5y ago
      > it would seem like an easily-avoidable source of vendor lock-in I have the same question / concern. I think it's great that AWS are offering their own flavour of Linux, but doesn't that result in added risk of vendor lock-in? Whereas with an Ubuntu instance, one can change cloud providers quite easily [0], without being tied into AWS-specific Linux configurations [1]. [0] I think AWS is great, so this is more a hypothetical scenario. [1] I say this knowing little about AWS Linux and the degree to which it has custom configurations that can't easily plug-and-play on other distros. Would appreciate insight from someone who can speak to this risk from experience.
- strzibny 5y ago
  A level of support within AWS. ...and with this new version, a great support for SELinux too (because of Fedora). Some don't like the push for Snaps as well. I think SELinux is one of the biggest differences and the hardest to adapt to (as changing apt to dnf is not hard). If you want a good starter on SELinux, my whole book on deployment[0] is SELinux ready with a full dedicated chapter on SELinux and a SELinux cheatsheet. Today also with a 33% off for Black Friday ("blackfriday" discount code at checkout). [0] https://deploymentfromscratch.com/ https://deploymentfromscratch.com/
  - saurik 5y ago
    "because of Fedora" <- So, why not use Fedora? Is it Amazon Linux that you find awesome or whatever Amazon Linux is based on?
    - strzibny 5y ago
      I would prefer Fedora, but if I am on AWS and Amazon Linux is the one that gets the awesome Amazon support, then choosing Amazon Linux might be compelling. Of course I would prefer they use Fedora and contribute to Fedora directly.
- fulafel 5y ago
  Lots of developers / dev orgs are AWS users first, Linux users second and so they don't have strong opinions or experience about that.
mark_l_watson 5y ago
On AWS, I always now use Amazon's Linux distro. They also maintain their own version of OpenJDK. As skeptical as I am about huge tech corps like Amazon, Google, etc., I have to admit I enjoy being their paying customer - nice experience. I find GCP and AWS a pleasure to use.
- alexdong 5y ago
  Are there any quantities data for the performance comparison like they did for Aurora vs MySQL? Thanks
  - takeda 5y ago
    Well, it is generally more likely to be tuned to AWS, containing right drivers and tools installed than a default distro you would download from the website, but the images that are available on AWS would likely also tuned similarly. If there are some issues where other image is noticeable worse they would look into AmazonLinux and apply the changes from it. I would say that AmazonLinux is likely to have less issues with latest instance types (if they change something "hardware" wise, for example when AWS started exposing EBS using NVMe drivers there were some issues originally).
- m0zg 5y ago
  How do you develop for it though? Do you install it locally as well? Or do you only do interpreted languages and/or Java? I suppose Go would work across distros also (because it doesn't use libc), but that's all I can think of.
  - shaicoleman 5y ago
    Currently you have to launch an EC2 instance to test it. Once it's GA, they'll provide VM images and docker containers, so you'll be able to test it offline
  - throwaway984393 5y ago
    You should just develop your apps in/with/for containers. The container contains all the dependencies for your app. This way you never have to think about the host OS ever again; your app "just works" (once you hook up the networking, environment, secrets, storage, logging, etc for whatever is running your container). That sounds like a lot of extra work, but actually it's just standardizing the things you should already be dealing with even if you didn't use containers. The end result is your app works more reliably and you can run it anywhere.
shaicoleman 5y ago
TLDR: * Will be released on a predictable schedule every 2 years, supported for 5 years. Minor releases every quarter. * GA will be based on Fedora 35. Preview is currently based on Fedora 34 * There's no official statement regarding compatibility with Fedora packages * SELinux will be enforcing by default * Kernel will be a kernel.org longterm version, not the Fedora one * VM images/docker containers will be officially available when GA. For now you can download images unoffically [1] * Unofficial ETA is Q2 2022. For reference, AL2 is currently officially supported until June 30, 2023. 1. https://news.ycombinator.com/item?id=29344927 https://news.ycombinator.com/item?id=29344927
- chronogram 5y ago
  You make no mention of it being a rebuild of RHEL 9 beta, so are they making their own EL based on F35 or is it based on RHEL 9?
  - shaicoleman 5y ago
    It's not based on RHEL. They're making their own distro which is based on Fedora.
  - smarx007 5y ago
    This sounds closer to what CentOS Stream is planning to be but with a 2-year release cadence instead of 3?
cpach 5y ago
I don’t understand why this is based on Fedora. Isn’t that more of a desktop distro…? And this seems more aimed at virtual machines running on EC2…? Or am I missing something? It’s also interesting that at the same time Amazon is sponsoring Rocky Linux: https://rockylinux.org/sponsors/ https://rockylinux.org/sponsors/ (Which is based on Red Hat Enterprise Linux.)
- shaicoleman 5y ago
  "Our release cadence (new major version every 2 years) best lines up with a highly predictable release cadence of an upstream distribution such as Fedora." "We believe that having Fedora as upstream allows us to meet the needs of the customers that we talked to in terms of flexibility and pulling in newer packages." https://www.reddit.com/r/aws/comments/qzxkh3/comment/hlptw7l/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/aws/comments/qzxkh3/comment/hlptw7l...
  - bamboozled 5y ago
    Stability is important but less and less people seem to want to run 4 year old software.
    - cpach 5y ago
      I think it depends quite a bit on the circumstances. And as long as the kernel is decently fresh, one can run new shiny software using containers instead.
    - nicce 5y ago
      It depends on how do you define stability. Fedora packages are very stable in terms of bugs, but the problem of changes between versions might cause extra work. However, many run their services in containers anyway, and you can use the latest packages on your host.
- bluedino 5y ago
  Fedora has a server edition, and everything in RHEL/CentOS is old
iou 5y ago
I'm a big SELinux fan and user. Enabling it won't in itself secure your company's applications, as the default policies in Fedora only apply to installed services (e.g ssh) that have a policy written for them. This is probably right on the boundary of the shared-security-model, but I think it would be great if they also offered easier ways for application developers to leverage the advertised feature.
- CameronNemo 5y ago
  FWIW, Docker, podman, LXC, and Kubernetes will apply SELinux policies to containers automatically if you have that support enabled at build time (many distributions do have it enabled, esp Fedora family) and SELinux enabled at runtime. Likewise for AppArmor.
  - imachine1980_ 5y ago
    most servers use debian or ubuntu, i think this will be greate and maybe even a killer feuture to change a little the landscape, but i don't think is as much impact as we wish in at least the next 5 years
  - iou 5y ago
    Yes,agreed. & AWS are active in this area moreso with bottlerocket-os https://aws.amazon.com/blogs/opensource/security-features-of-bottlerocket-an-open-source-linux-based-operating-system/ https://aws.amazon.com/blogs/opensource/security-features-of... The recent release even incorporating the use of a feature I had previously dismissed as useless (MCS) is really quite neat https://github.com/bottlerocket-os/bottlerocket/discussions/1747 https://github.com/bottlerocket-os/bottlerocket/discussions/...
- technofiend 5y ago
  You're not wrong, but writing selinux policy isn't that complicated. You can easily look at ausearch output to understand why a constrained process failed and brute force a policy using audit2allow. Although as the policy writer becomes more familiar with selinux and their app, they can write better policy.
Shadonototra 5y ago
I can see linux eclipsing all the current OS's, it already happened with smartphones, IOTs and the other little things (i forgot how they are called) Only remaining piece is the desktop segment macOS has a unix environment, so it'll stay relevant (for how long?) windows has WSL, it's slow, i don't see myself using it since the host OS is a giant piece of shitty crap MS missed a chance with Win11, they could have went full steam ARM with a Linux Distro, 100% native Android support, 100% cloud native support, 100% unix support as a host OS, i wouldn't use it myself because i despise the company and its culture, but i can see potential, and i smell a huge missed opportunity Amazon it getting it right, even thought it's exclusively targeting for cloud usages Marketing wise it's great and consistent with their offering
- Icathian 5y ago
  While I would love for this to happen, I just don't see it at all. There are literally millions of Windows workstations or laptops across corporate campuses in the US, because at the end of the day what 95% of white collar workers need to do their jobs is MS Office and *maybe* one industry-specific LoB app.
  - charcircuit 5y ago
    Isn't MS Office a web app now?
    - mixmastamyk 5y ago
      Yes, and considering the google office, that percentage is a lot lower currently.
- rch 5y ago
  Last I checked, WSL wasn't available for Windows Server, unfortunately.
  - paranoidrobot 5y ago
    What's your use-case for WSL on Windows Server, if you don't mind me asking?
staticassertion 5y ago
Looks interesting. SELinux by default is certainly a win, it seems that Linux has finally hit a tipping point where SELinux is a reasonable option (ie: someone else is going to do the work for you). Unfortunately I'm just way more used to debian based systems, and I feel like having a mismatch in production would just lead to friction.
- jlawer 5y ago
  RHEL running with SELinux enabled has been a thing since I worked at Red Hat 12 years ago, and Amazon Linux 2 was based on a CentOS upstream that had the capability of running in that way. All certification had to happen with SELinux enabled, and any distro provided service was setup to run with full restrictions, and it was the default on for all Professional Services work. However it became a problem once you used 3rd party software as step 1 of most install guides was to disable SELinux.
  - chasil 5y ago
    I use systemd units to start Oracle databases. These come up unconfined by default in RHEL 7, but this behavior changed in RHEL 8. I don't remember the specifics, but Oracle support confirmed that it should be assigned unconfined in the newer OS. This is essentially "setenforce 0" for a process, as I understand it.
- takeda 5y ago
  In RedHat or CentOS it was enabled by default as well for a long while. The problem was that if you installed custom software (not packaged by the distro) you had two options: - create and install SELinux rules for it - disable SELinux Unfortunately most did not bother to learn how to do the first option so they go with the 2nd.
- edgyquant 5y ago
  SELinux has always been a reasonable option but it’s just scarier than people are used to. I used Fedora for a couple of years and was surprised by how straight forward it was once I understood it.
- 5y ago
vosper 5y ago
Perhaps someone could give me some advice? I work alongside a small team maintaining quite a lot of machines on AWS. They're struggling (IMHO) to manually apply all of the security patches their scanning tool identifies. My theory is that Amazon Linux gets patched frequently, and so they'd be better off spending time normalizing our EC2 infra so that every instance is running Amazon Linux, and then work on an easy rollout mechanism to deploy the latest version. Has anyone got any thoughts on this? It wouldn't obviate the need for patching completely, but I feel like AWS is already doing some of this work for us, so we should take advantage.
- rusteh1 5y ago
  Yes, one of the core benefits of a provider like AWS is that they provide tooling to treat individual instances as immutable entities that you simply replace without any interruption to your users. You should focus on expressing the infrastructure as code and using mechanisms like ASGs to roll out new instances based on the latest Amazon provided AMIs.
- windowsworkstoo 5y ago
  Yep we do this, works good - you can either trigger a server refresh from SNS (AWS notifies you of certain AMI updates) or we just rebuild our underlying fleet each week with the most current AL2 AMI
- voidfunc 5y ago
  Every mainstream upstream Linux vendor is continuously pushing updated AMIs. It shouldn’t really matter whether you solve this with Ubuntu or Amazon Linux or RHEL/CentOS. Sounds like you need a better process / automation for rolling updates. Either continuously rebuilt golden images or rolling security patches, or turning on your distros unattended upgrade mechanism could be solutions depending on your environment.
- gtirloni 5y ago
  If you can, definitely standardize on as few distros as possible. It'll make applying patches (and learning when things go wrong, because they will) much easier. We used to have all sorts of distros that people just felt like using without worrying about their maintainability. We kept fighting fires to keep everything running. Once we standardized on a single distro (CentOS at the time), everything started working much more smoothly. We could have picked Debian, Ubuntu, it doesn't matter. That being said, Amazon Linux 2 is pretty well maintained. Most things (all?) that work on RHEL, will work on it. You may need to use 3rd-party repos if you want really newer stuff (eg. PHP) but that's inherent to such LTS releases. That situation is expected to improve with the improvements that adopting Fedora brings in AL2022 but I need to catch up.
rubyist5eva 5y ago
An LTS distribution based on Fedora (and NOT RHEL) is something I've been wanting for a long time, but I don't think this is really gonna be for the non-cloud general use case? Welp, better luck next time.
- brnt 5y ago
  Same here. It's not clear to me if this distro is indeed viable for the desktop, and hoe exactly they support the Fedora packages past Fedora lifetime (or whether they'll even supply all of the Fedora repos). A Fedora LTS is exactly what I'm looking for.
- IceWreck 5y ago
  But RHEL is based on Fedora. Every X releases Red hat forks Fedora and builds the next major version of RHEL on top of it. So RHEL/CentOS/Alma Linux/Rocky are Fedora LTS.
  - rubyist5eva 5y ago
    But I can't do direct upgrades between RHEL versions. I want Ubuntu LTS style support but with Fedora and direct upgrades between LTS versions. For what it's worth - I'm currently running OpenSUSE Leap and MicroOS (immutable OpenSUSE Tumbleweed variant) - and they run a nice middle ground, but I still have to do major upgrades for my Leap systems every year or so between their point release updates, which is kindof a pain. I just wish I could use Fedora with ~3 years of support because that's the system and tools that I'm most familiar with (we used CentOS at work, recently migrated to Alma).
    - deleted 5y ago
      [deleted]
linpack21 5y ago
As a happy user of AWS Linux 2, it is extremely disappointing that they're no longer providing a drop-in RHEL replacement for EC2. I don't see any mention of things we and many large shops like ours care about - long term support and RHEL compatibility. We've been very vocal to AWS product managers and solution architects about our needs for an Amazon Linux 3 that is a refresh over AWS Linux 2 (at least 5 years support with RHEL 8 compatibility, free kernel patching w/o reboots, official support from datadog, vmware images). Sad that we haven't been heard. We'll now need to plan to move over 20k instances to Rocky Linux. I suspect that the move to using Fedora has something to do with changes to the CentOS project that AWS Linux 2 forked. Let's hope the beancounters at IBM doesn't have other plans for Fedora.
- whydid 5y ago
  It's almost like RH/IBM made this change to prevent AWS/Oracle from cloning their OS!
- circularfoyers 5y ago
  > Let's hope the beancounters at IBM doesn't have other plans for Fedora. What do you think they would potentially do? Fedora is the upstream for RHEL, it's integral to it. Part of the reason they dropped support for CentOS was because it didn't serve to benefit RHEL very much.
- pmorici 5y ago
  You could pay Red Hat for licenses if it's that important to you. But as far as I can tell Amazon is a major supporter of Rocky Linux so sounds like they heard you and are giving you exactly what you want.
  - jaboutboul 5y ago
    Actually Amazon is just providing them with open source credits, much like they do for every other open source project.
  - hdjjhhvvhga 5y ago
    s/major/vocal/
bloopernova 5y ago
Hopefully Fedora gets a lot of extra eyes and brains because of this. Cool, it's been my desktop OS for a long time.
- Andrex 5y ago
  I used it from 2012-2015 on my main machine, and now after a mix of Windows, macOS and Chrome OS, I'm back to Fedora as of this week. I enjoy Fedora but I really like Gnome. It was also the only real option for me given Ubuntu's continued push for Snap, which I just don't like.
  - 1_player 5y ago
    I have used Arch Linux for 10+ years, then shortly macOS and Windows, and to Fedora as of yesterday as well. Red Hat is employing and paying for most of the desktop and server userspace developers (GNOME, systemd, pipewire, podman, ostree), I might as well use their official distro. It's the closest thing to bleeding edge and forward looking distribution that dictates the pace for everybody else to follow. I like that. I liked ubuntu when it first released, but modern day Canonical is a shell of its former self. Snap is their sad attempt at EEE from Microsoft's playbook. And I have never liked Debian, even when it's been running on my servers since forever.
    - Andrex 5y ago
      > Red Hat is employing and paying for most of the desktop and server userspace developers (GNOME, systemd, pipewire, podman, ostree), I might as well use their official distro. Yeah, that's pretty much my methodology for why I went Fedora too. Although I didn't know Red Hat was that deep into upstream work (awesome!), but it makes total sense. > I liked ubuntu when it first released, but modern day Canonical is a shell of its former self. Snap is their sad attempt at EEE from Microsoft's playbook. Yup. It's sad all around. Ubuntu was my first ever non-Windows OS back in 2006 or so. I feel like every few years I mentally shout "YOU WERE THE CHOSEN ONE!" to Canonical, haha.
jeppesen-io 5y ago
Big fan of using a largely upstream Linux kernel. In general, I've been very happy with AWS Linux kernels vs. Ubuntu and CentOS in AWS It's funny, I was just about to move to kernel 5.10 for amz Linux 2. Might just wait a bit for AL2022
proteinfolding 5y ago
They yanked my favorite part of AL2, the extras repo with new packages from EPEL and Fedora. SELinux by default is a welcome addition but I'm concerned it will break many apps.
- gerl1ng 5y ago
  Interesting. For me the amazon-linux-extras part was the most annoying part. Using automation tooling (Terraform for instance deployment and Ansible in User Data of instances) it was so annoying to work with. Fallback to the shell executor in Ansible to get something installed is a pita. Also good that they finally get out of a python2 default Amazon Linux - only 2.5 years after it's EOL.
rawoke083600 5y ago
The litmus test these days for distros are: Will it remove my DE when I install steam ? /s *LTT Video Series :D
- Underphil 5y ago
  This is not a desktop distribution by any means. Keep the LTT nonsense to YouTube, please.
  - rawoke083600 5y ago
    Lol obvious! - Why so angry ?
jmnicolas 5y ago
Can I get an ISO of this distro without having an Amazon account? I checked the few links on the page but found nothing.
- digitalsushi 5y ago
  Cloud images are harder to find as ISOs ... They are using this 'cloud image' concept where they distribute something very similar or equal to an OVA, which is the hard disk and a manifest. https://cdn.amazonlinux.com/os-images/2.0.20210721.2/ https://cdn.amazonlinux.com/os-images/2.0.20210721.2/ If you go here, there's OVA files, VDI, container, and a few other formats, and you can easily translate them to some more esoteric formats.
Dowwie 5y ago
Has anyone gotten lld linker to work with any version of Amazon Linux?
zsh_lover 5y ago
Looks like a regression from AL2 in the area of compatibility preserving updates. AL2022 does not make any commitments similar to AL2 (see text from link below). It is therefore borderline unusable for enterprises that value stability like my current employer. https://aws.amazon.com/amazon-linux-2/faqs/ https://aws.amazon.com/amazon-linux-2/faqs/ 1) AWS will provide security updates and bug fixes for all packages in core [for 5 yrs] 2) AWS will maintain user-space Application Binary Interface (ABI) compatibility for the following packages in core: elfutils-libelf, glibc, glibc-utils, hesiod, krb5-libs, libgcc, libgomp, libstdc++, libtbb.so, libtbbmalloc.so, libtbbmalloc_proxy.so, libusb, libxml2, libxslt, pam, audit-libs, audit-libs-python, bzip2-libs, c-ares, clutter, cups-libs, cyrus-sasl-gssapi, cyrus-sasl-lib, cyrus-sasl-md5, dbus-glib, dbus-libs, elfutils-libs, expat, fuse-libs, glib2, gmp, gnutls, httpd, libICE, libSM, libX11, libXau, libXaw, libXext, libXft, libXi, libXinerama, libXpm, libXrandr, libXrender, libXt, libXtst, libacl, libaio, libatomic, libattr, libblkid, libcap-ng, libdb, libdb-cxx, libgudev1, libhugetlbfs, libnotify, libpfm, libsmbclient, libtalloc, libtdb, libtevent, libusb, libuuid, ncurses-libs, nss, nss-sysinit, numactl, openssl, p11-kit, papi, pcre, perl, perl-Digest-SHA, perl-Time-Piece, perl-libs, popt, python, python-libs, readline, realmd, ruby, scl-utils, sqlite, systemd-libs, systemtap, tcl, tcp_wrappers-libs, xz-libs, and zlib 3) AWS will provide Application Binary Interface (ABI) compatibility for all other packages in core unless providing such compatibility is not possible for reasons beyond AWS’s control.

Amazon Linux 2022

270 points by gtirloni 5y ago

saurik 5y ago

Why do people choose Amazon Linux over, say, an Ubuntu LTS?

shaicoleman 5y ago
While I prefer Ubuntu myself, we use Amazon Linux because: * It has support for all new instances/hardware/services on day 1 * It's optimised for AWS, sometimes a bit faster than Ubuntu * It has a good balance of freshness, stability and long term support * It comes with integrations to all of AWS services and ecosystem * It's the default choice, and often the least hassle * It's fully supported by AWS * It's the only realistic choice for some services (e.g. Lambda, Elastic Beanstalk)
- Jeff_Brown 5y ago
  > a good balance of freshness ... I'm surprised to read that. Coming from Ubuntu and in the last couple years NixOS I've found the Yum repos for Amazon Linux woefully stale.
  - shaicoleman 5y ago
    AL2 comes with amazon-linux-extras. It provides newer versions for a few key packages, e.g.: Docker 20.10, PostgreSQL 13, Ruby 3.0, Kernel 5.10, nginx 1.20, PHP 8.0, Python 3.8, Redis 6.2, Go 1.15, Rust 1.47, etc. Some newer packages, e.g. OpenSSL 1.1.1 and zsh 5.7 are provided in the main repo. Outdated packages wasn't a major pain point in my experience. The bigger issue is a relative small selection of packages. These are either available via 3rd party repos (e.g. NodeJS) or EPEL (e.g. libsodium), or by recompiling Fedora SRPMS. That can be an inconvenience, but not a big deal overall. I hope the situation will improve once AL2022 is out, as Fedora comes with a much wider selection of packages.
throwdbaaway 5y ago
On AWS, there are serious issues such as https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1331150/ https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1331150..., that only requires a simple sysctl workaround, yet AWS would only put the workaround into the Amazon Linux images. Meanwhile, the same issue was actually fixed once and for all on GCP: https://news.ycombinator.com/item?id=8732356 https://news.ycombinator.com/item?id=8732356
whalesalad 5y ago
There are really two primary camps - RedHat based (CentOS, Rocky Linux, Amazon Linux, etc) and Debian based (Debian, Ubuntu, etc). There are of course many other bloodlines - but these are the most common in production environments and more specifically cloud env. If you are familiar with one version of linux that is RH based, you will tend to gravitate to others with similar DNA. Likewise, if you come from Debian/Ubuntu you will tend to stick with those. At the end of the day they are both Linux, but each has their own approach to configuration, where things go, package management, etc. You really can't go wrong with either - use what you prefer.
- saurik 5y ago
  FWIW, the real brunt of my question was why one would go with a cloud-provider specific operating system over one from a group like Canonical or RedHat, as I would naively expect it to have less support and particularly less ecosystem-wide understanding and experience while not being available for other systems, and so it would seem like an easily-avoidable source of vendor lock-in. If I were be part of Camp RedHat I would personally use CentOS, not "Amazon Linux", unless there was some extremely good reason why Amazon Linux in specific was awesome.
  - rob-olmos 5y ago
    Besides going the path of least resistance in AWS, possibly to get OS & package support from AWS if there's already an enterprise-level support plan in place, rather than needing to buy other support subscriptions (eg, RHEL)? AM2 is able to run in other places so there doesn't seem to be much vendor lock-in compared to a service like DynamoDB, though.
  - herodoturtle 5y ago
    > it would seem like an easily-avoidable source of vendor lock-in I have the same question / concern. I think it's great that AWS are offering their own flavour of Linux, but doesn't that result in added risk of vendor lock-in? Whereas with an Ubuntu instance, one can change cloud providers quite easily [0], without being tied into AWS-specific Linux configurations [1]. [0] I think AWS is great, so this is more a hypothetical scenario. [1] I say this knowing little about AWS Linux and the degree to which it has custom configurations that can't easily plug-and-play on other distros. Would appreciate insight from someone who can speak to this risk from experience.
strzibny 5y ago
A level of support within AWS. ...and with this new version, a great support for SELinux too (because of Fedora). Some don't like the push for Snaps as well. I think SELinux is one of the biggest differences and the hardest to adapt to (as changing apt to dnf is not hard). If you want a good starter on SELinux, my whole book on deployment[0] is SELinux ready with a full dedicated chapter on SELinux and a SELinux cheatsheet. Today also with a 33% off for Black Friday ("blackfriday" discount code at checkout). [0] https://deploymentfromscratch.com/ https://deploymentfromscratch.com/
- saurik 5y ago
  "because of Fedora" <- So, why not use Fedora? Is it Amazon Linux that you find awesome or whatever Amazon Linux is based on?
  - strzibny 5y ago
    I would prefer Fedora, but if I am on AWS and Amazon Linux is the one that gets the awesome Amazon support, then choosing Amazon Linux might be compelling. Of course I would prefer they use Fedora and contribute to Fedora directly.
fulafel 5y ago
Lots of developers / dev orgs are AWS users first, Linux users second and so they don't have strong opinions or experience about that.

mark_l_watson 5y ago

On AWS, I always now use Amazon's Linux distro. They also maintain their own version of OpenJDK. As skeptical as I am about huge tech corps like Amazon, Google, etc., I have to admit I enjoy being their paying customer - nice experience. I find GCP and AWS a pleasure to use.

alexdong 5y ago
Are there any quantities data for the performance comparison like they did for Aurora vs MySQL? Thanks
- takeda 5y ago
  Well, it is generally more likely to be tuned to AWS, containing right drivers and tools installed than a default distro you would download from the website, but the images that are available on AWS would likely also tuned similarly. If there are some issues where other image is noticeable worse they would look into AmazonLinux and apply the changes from it. I would say that AmazonLinux is likely to have less issues with latest instance types (if they change something "hardware" wise, for example when AWS started exposing EBS using NVMe drivers there were some issues originally).
m0zg 5y ago
How do you develop for it though? Do you install it locally as well? Or do you only do interpreted languages and/or Java? I suppose Go would work across distros also (because it doesn't use libc), but that's all I can think of.
- shaicoleman 5y ago
  Currently you have to launch an EC2 instance to test it. Once it's GA, they'll provide VM images and docker containers, so you'll be able to test it offline
- throwaway984393 5y ago
  You should just develop your apps in/with/for containers. The container contains all the dependencies for your app. This way you never have to think about the host OS ever again; your app "just works" (once you hook up the networking, environment, secrets, storage, logging, etc for whatever is running your container). That sounds like a lot of extra work, but actually it's just standardizing the things you should already be dealing with even if you didn't use containers. The end result is your app works more reliably and you can run it anywhere.

shaicoleman 5y ago

TLDR: * Will be released on a predictable schedule every 2 years, supported for 5 years. Minor releases every quarter. * GA will be based on Fedora 35. Preview is currently based on Fedora 34 * There's no official statement regarding compatibility with Fedora packages * SELinux will be enforcing by default * Kernel will be a kernel.org longterm version, not the Fedora one * VM images/docker containers will be officially available when GA. For now you can download images unoffically [1] * Unofficial ETA is Q2 2022. For reference, AL2 is currently officially supported until June 30, 2023. 1. https://news.ycombinator.com/item?id=29344927 https://news.ycombinator.com/item?id=29344927

chronogram 5y ago
You make no mention of it being a rebuild of RHEL 9 beta, so are they making their own EL based on F35 or is it based on RHEL 9?
- shaicoleman 5y ago
  It's not based on RHEL. They're making their own distro which is based on Fedora.
- smarx007 5y ago
  This sounds closer to what CentOS Stream is planning to be but with a 2-year release cadence instead of 3?

cpach 5y ago

I don’t understand why this is based on Fedora. Isn’t that more of a desktop distro…? And this seems more aimed at virtual machines running on EC2…? Or am I missing something? It’s also interesting that at the same time Amazon is sponsoring Rocky Linux: https://rockylinux.org/sponsors/ https://rockylinux.org/sponsors/ (Which is based on Red Hat Enterprise Linux.)

shaicoleman 5y ago
"Our release cadence (new major version every 2 years) best lines up with a highly predictable release cadence of an upstream distribution such as Fedora." "We believe that having Fedora as upstream allows us to meet the needs of the customers that we talked to in terms of flexibility and pulling in newer packages." https://www.reddit.com/r/aws/comments/qzxkh3/comment/hlptw7l/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/aws/comments/qzxkh3/comment/hlptw7l...
- bamboozled 5y ago
  Stability is important but less and less people seem to want to run 4 year old software.
  - cpach 5y ago
    I think it depends quite a bit on the circumstances. And as long as the kernel is decently fresh, one can run new shiny software using containers instead.
  - nicce 5y ago
    It depends on how do you define stability. Fedora packages are very stable in terms of bugs, but the problem of changes between versions might cause extra work. However, many run their services in containers anyway, and you can use the latest packages on your host.
bluedino 5y ago
Fedora has a server edition, and everything in RHEL/CentOS is old

iou 5y ago

I'm a big SELinux fan and user. Enabling it won't in itself secure your company's applications, as the default policies in Fedora only apply to installed services (e.g ssh) that have a policy written for them. This is probably right on the boundary of the shared-security-model, but I think it would be great if they also offered easier ways for application developers to leverage the advertised feature.

CameronNemo 5y ago
FWIW, Docker, podman, LXC, and Kubernetes will apply SELinux policies to containers automatically if you have that support enabled at build time (many distributions do have it enabled, esp Fedora family) and SELinux enabled at runtime. Likewise for AppArmor.
- imachine1980_ 5y ago
  most servers use debian or ubuntu, i think this will be greate and maybe even a killer feuture to change a little the landscape, but i don't think is as much impact as we wish in at least the next 5 years
- iou 5y ago
  Yes,agreed. & AWS are active in this area moreso with bottlerocket-os https://aws.amazon.com/blogs/opensource/security-features-of-bottlerocket-an-open-source-linux-based-operating-system/ https://aws.amazon.com/blogs/opensource/security-features-of... The recent release even incorporating the use of a feature I had previously dismissed as useless (MCS) is really quite neat https://github.com/bottlerocket-os/bottlerocket/discussions/1747 https://github.com/bottlerocket-os/bottlerocket/discussions/...
technofiend 5y ago
You're not wrong, but writing selinux policy isn't that complicated. You can easily look at ausearch output to understand why a constrained process failed and brute force a policy using audit2allow. Although as the policy writer becomes more familiar with selinux and their app, they can write better policy.

Shadonototra 5y ago

I can see linux eclipsing all the current OS's, it already happened with smartphones, IOTs and the other little things (i forgot how they are called) Only remaining piece is the desktop segment macOS has a unix environment, so it'll stay relevant (for how long?) windows has WSL, it's slow, i don't see myself using it since the host OS is a giant piece of shitty crap MS missed a chance with Win11, they could have went full steam ARM with a Linux Distro, 100% native Android support, 100% cloud native support, 100% unix support as a host OS, i wouldn't use it myself because i despise the company and its culture, but i can see potential, and i smell a huge missed opportunity Amazon it getting it right, even thought it's exclusively targeting for cloud usages Marketing wise it's great and consistent with their offering

Icathian 5y ago
While I would love for this to happen, I just don't see it at all. There are literally millions of Windows workstations or laptops across corporate campuses in the US, because at the end of the day what 95% of white collar workers need to do their jobs is MS Office and *maybe* one industry-specific LoB app.
- charcircuit 5y ago
  Isn't MS Office a web app now?
  - mixmastamyk 5y ago
    Yes, and considering the google office, that percentage is a lot lower currently.
rch 5y ago
Last I checked, WSL wasn't available for Windows Server, unfortunately.
- paranoidrobot 5y ago
  What's your use-case for WSL on Windows Server, if you don't mind me asking?

staticassertion 5y ago

Looks interesting. SELinux by default is certainly a win, it seems that Linux has finally hit a tipping point where SELinux is a reasonable option (ie: someone else is going to do the work for you). Unfortunately I'm just way more used to debian based systems, and I feel like having a mismatch in production would just lead to friction.

jlawer 5y ago
RHEL running with SELinux enabled has been a thing since I worked at Red Hat 12 years ago, and Amazon Linux 2 was based on a CentOS upstream that had the capability of running in that way. All certification had to happen with SELinux enabled, and any distro provided service was setup to run with full restrictions, and it was the default on for all Professional Services work. However it became a problem once you used 3rd party software as step 1 of most install guides was to disable SELinux.
- chasil 5y ago
  I use systemd units to start Oracle databases. These come up unconfined by default in RHEL 7, but this behavior changed in RHEL 8. I don't remember the specifics, but Oracle support confirmed that it should be assigned unconfined in the newer OS. This is essentially "setenforce 0" for a process, as I understand it.
takeda 5y ago
In RedHat or CentOS it was enabled by default as well for a long while. The problem was that if you installed custom software (not packaged by the distro) you had two options: - create and install SELinux rules for it - disable SELinux Unfortunately most did not bother to learn how to do the first option so they go with the 2nd.
edgyquant 5y ago
SELinux has always been a reasonable option but it’s just scarier than people are used to. I used Fedora for a couple of years and was surprised by how straight forward it was once I understood it.
5y ago

vosper 5y ago

Perhaps someone could give me some advice? I work alongside a small team maintaining quite a lot of machines on AWS. They're struggling (IMHO) to manually apply all of the security patches their scanning tool identifies. My theory is that Amazon Linux gets patched frequently, and so they'd be better off spending time normalizing our EC2 infra so that every instance is running Amazon Linux, and then work on an easy rollout mechanism to deploy the latest version. Has anyone got any thoughts on this? It wouldn't obviate the need for patching completely, but I feel like AWS is already doing some of this work for us, so we should take advantage.

rusteh1 5y ago
Yes, one of the core benefits of a provider like AWS is that they provide tooling to treat individual instances as immutable entities that you simply replace without any interruption to your users. You should focus on expressing the infrastructure as code and using mechanisms like ASGs to roll out new instances based on the latest Amazon provided AMIs.
windowsworkstoo 5y ago
Yep we do this, works good - you can either trigger a server refresh from SNS (AWS notifies you of certain AMI updates) or we just rebuild our underlying fleet each week with the most current AL2 AMI
voidfunc 5y ago
Every mainstream upstream Linux vendor is continuously pushing updated AMIs. It shouldn’t really matter whether you solve this with Ubuntu or Amazon Linux or RHEL/CentOS. Sounds like you need a better process / automation for rolling updates. Either continuously rebuilt golden images or rolling security patches, or turning on your distros unattended upgrade mechanism could be solutions depending on your environment.
gtirloni 5y ago
If you can, definitely standardize on as few distros as possible. It'll make applying patches (and learning when things go wrong, because they will) much easier. We used to have all sorts of distros that people just felt like using without worrying about their maintainability. We kept fighting fires to keep everything running. Once we standardized on a single distro (CentOS at the time), everything started working much more smoothly. We could have picked Debian, Ubuntu, it doesn't matter. That being said, Amazon Linux 2 is pretty well maintained. Most things (all?) that work on RHEL, will work on it. You may need to use 3rd-party repos if you want really newer stuff (eg. PHP) but that's inherent to such LTS releases. That situation is expected to improve with the improvements that adopting Fedora brings in AL2022 but I need to catch up.

rubyist5eva 5y ago

An LTS distribution based on Fedora (and NOT RHEL) is something I've been wanting for a long time, but I don't think this is really gonna be for the non-cloud general use case? Welp, better luck next time.

brnt 5y ago
Same here. It's not clear to me if this distro is indeed viable for the desktop, and hoe exactly they support the Fedora packages past Fedora lifetime (or whether they'll even supply all of the Fedora repos). A Fedora LTS is exactly what I'm looking for.
IceWreck 5y ago
But RHEL is based on Fedora. Every X releases Red hat forks Fedora and builds the next major version of RHEL on top of it. So RHEL/CentOS/Alma Linux/Rocky are Fedora LTS.
- rubyist5eva 5y ago
  But I can't do direct upgrades between RHEL versions. I want Ubuntu LTS style support but with Fedora and direct upgrades between LTS versions. For what it's worth - I'm currently running OpenSUSE Leap and MicroOS (immutable OpenSUSE Tumbleweed variant) - and they run a nice middle ground, but I still have to do major upgrades for my Leap systems every year or so between their point release updates, which is kindof a pain. I just wish I could use Fedora with ~3 years of support because that's the system and tools that I'm most familiar with (we used CentOS at work, recently migrated to Alma).
  - deleted 5y ago
    [deleted]

linpack21 5y ago

As a happy user of AWS Linux 2, it is extremely disappointing that they're no longer providing a drop-in RHEL replacement for EC2. I don't see any mention of things we and many large shops like ours care about - long term support and RHEL compatibility. We've been very vocal to AWS product managers and solution architects about our needs for an Amazon Linux 3 that is a refresh over AWS Linux 2 (at least 5 years support with RHEL 8 compatibility, free kernel patching w/o reboots, official support from datadog, vmware images). Sad that we haven't been heard. We'll now need to plan to move over 20k instances to Rocky Linux. I suspect that the move to using Fedora has something to do with changes to the CentOS project that AWS Linux 2 forked. Let's hope the beancounters at IBM doesn't have other plans for Fedora.

whydid 5y ago
It's almost like RH/IBM made this change to prevent AWS/Oracle from cloning their OS!
circularfoyers 5y ago
> Let's hope the beancounters at IBM doesn't have other plans for Fedora. What do you think they would potentially do? Fedora is the upstream for RHEL, it's integral to it. Part of the reason they dropped support for CentOS was because it didn't serve to benefit RHEL very much.
pmorici 5y ago
You could pay Red Hat for licenses if it's that important to you. But as far as I can tell Amazon is a major supporter of Rocky Linux so sounds like they heard you and are giving you exactly what you want.
- jaboutboul 5y ago
  Actually Amazon is just providing them with open source credits, much like they do for every other open source project.
- hdjjhhvvhga 5y ago
  s/major/vocal/

bloopernova 5y ago

Hopefully Fedora gets a lot of extra eyes and brains because of this. Cool, it's been my desktop OS for a long time.

Andrex 5y ago
I used it from 2012-2015 on my main machine, and now after a mix of Windows, macOS and Chrome OS, I'm back to Fedora as of this week. I enjoy Fedora but I really like Gnome. It was also the only real option for me given Ubuntu's continued push for Snap, which I just don't like.
- 1_player 5y ago
  I have used Arch Linux for 10+ years, then shortly macOS and Windows, and to Fedora as of yesterday as well. Red Hat is employing and paying for most of the desktop and server userspace developers (GNOME, systemd, pipewire, podman, ostree), I might as well use their official distro. It's the closest thing to bleeding edge and forward looking distribution that dictates the pace for everybody else to follow. I like that. I liked ubuntu when it first released, but modern day Canonical is a shell of its former self. Snap is their sad attempt at EEE from Microsoft's playbook. And I have never liked Debian, even when it's been running on my servers since forever.
  - Andrex 5y ago
    > Red Hat is employing and paying for most of the desktop and server userspace developers (GNOME, systemd, pipewire, podman, ostree), I might as well use their official distro. Yeah, that's pretty much my methodology for why I went Fedora too. Although I didn't know Red Hat was that deep into upstream work (awesome!), but it makes total sense. > I liked ubuntu when it first released, but modern day Canonical is a shell of its former self. Snap is their sad attempt at EEE from Microsoft's playbook. Yup. It's sad all around. Ubuntu was my first ever non-Windows OS back in 2006 or so. I feel like every few years I mentally shout "YOU WERE THE CHOSEN ONE!" to Canonical, haha.

jeppesen-io 5y ago

Big fan of using a largely upstream Linux kernel. In general, I've been very happy with AWS Linux kernels vs. Ubuntu and CentOS in AWS It's funny, I was just about to move to kernel 5.10 for amz Linux 2. Might just wait a bit for AL2022

proteinfolding 5y ago

They yanked my favorite part of AL2, the extras repo with new packages from EPEL and Fedora. SELinux by default is a welcome addition but I'm concerned it will break many apps.

gerl1ng 5y ago
Interesting. For me the amazon-linux-extras part was the most annoying part. Using automation tooling (Terraform for instance deployment and Ansible in User Data of instances) it was so annoying to work with. Fallback to the shell executor in Ansible to get something installed is a pita. Also good that they finally get out of a python2 default Amazon Linux - only 2.5 years after it's EOL.

rawoke083600 5y ago

The litmus test these days for distros are: Will it remove my DE when I install steam ? /s *LTT Video Series :D

Underphil 5y ago
This is not a desktop distribution by any means. Keep the LTT nonsense to YouTube, please.
- rawoke083600 5y ago
  Lol obvious! - Why so angry ?

jmnicolas 5y ago

Can I get an ISO of this distro without having an Amazon account? I checked the few links on the page but found nothing.

digitalsushi 5y ago
Cloud images are harder to find as ISOs ... They are using this 'cloud image' concept where they distribute something very similar or equal to an OVA, which is the hard disk and a manifest. https://cdn.amazonlinux.com/os-images/2.0.20210721.2/ https://cdn.amazonlinux.com/os-images/2.0.20210721.2/ If you go here, there's OVA files, VDI, container, and a few other formats, and you can easily translate them to some more esoteric formats.

Dowwie 5y ago

Has anyone gotten lld linker to work with any version of Amazon Linux?

zsh_lover 5y ago

Looks like a regression from AL2 in the area of compatibility preserving updates. AL2022 does not make any commitments similar to AL2 (see text from link below). It is therefore borderline unusable for enterprises that value stability like my current employer. https://aws.amazon.com/amazon-linux-2/faqs/ https://aws.amazon.com/amazon-linux-2/faqs/ 1) AWS will provide security updates and bug fixes for all packages in core [for 5 yrs] 2) AWS will maintain user-space Application Binary Interface (ABI) compatibility for the following packages in core: elfutils-libelf, glibc, glibc-utils, hesiod, krb5-libs, libgcc, libgomp, libstdc++, libtbb.so, libtbbmalloc.so, libtbbmalloc_proxy.so, libusb, libxml2, libxslt, pam, audit-libs, audit-libs-python, bzip2-libs, c-ares, clutter, cups-libs, cyrus-sasl-gssapi, cyrus-sasl-lib, cyrus-sasl-md5, dbus-glib, dbus-libs, elfutils-libs, expat, fuse-libs, glib2, gmp, gnutls, httpd, libICE, libSM, libX11, libXau, libXaw, libXext, libXft, libXi, libXinerama, libXpm, libXrandr, libXrender, libXt, libXtst, libacl, libaio, libatomic, libattr, libblkid, libcap-ng, libdb, libdb-cxx, libgudev1, libhugetlbfs, libnotify, libpfm, libsmbclient, libtalloc, libtdb, libtevent, libusb, libuuid, ncurses-libs, nss, nss-sysinit, numactl, openssl, p11-kit, papi, pcre, perl, perl-Digest-SHA, perl-Time-Piece, perl-libs, popt, python, python-libs, readline, realmd, ruby, scl-utils, sqlite, systemd-libs, systemtap, tcl, tcp_wrappers-libs, xz-libs, and zlib 3) AWS will provide Application Binary Interface (ABI) compatibility for all other packages in core unless providing such compatibility is not possible for reasons beyond AWS’s control.