Create nodes with optimized Bottlerocket AMIs

Bottlerocket is an open source Linux distribution that’s sponsored and supported by AWS. Bottlerocket is purpose-built for hosting container workloads. With Bottlerocket, you can improve the availability of containerized deployments and reduce operational costs by automating updates to your container infrastructure. Bottlerocket includes only the essential software to run containers, which improves resource usage, reduces security threats, and lowers management overhead. The Bottlerocket AMI includes containerd, kubelet, and AWS IAM Authenticator. In addition to managed node groups and self-managed nodes, Bottlerocket is also supported by Karpenter.

Advantages

Using Bottlerocket with your Amazon EKS cluster has the following advantages:

• Higher uptime with lower operational cost and lower management complexity – Bottlerocket has a smaller resource footprint, shorter boot times, and is less vulnerable to security threats than other Linux distributions. Bottlerocket’s smaller footprint helps to reduce costs by using less storage, compute, and networking resources.

• Improved security from automatic OS updates – Updates to Bottlerocket are applied as a single unit which can be rolled back, if necessary. This removes the risk of corrupted or failed updates that can leave the system in an unusable state. With Bottlerocket, security updates can be automatically applied as soon as they’re available in a minimally disruptive manner and be rolled back if failures occur.

• Premium support – AWS provided builds of Bottlerocket on Amazon EC2 is covered under the same AWS Support plans that also cover AWS services such as Amazon EC2, Amazon EKS, and Amazon ECR.

Considerations

Consider the following when using Bottlerocket for your AMI type:

• Bottlerocket supports Amazon EC2 instances with x86_64 and arm64 processors. The Bottlerocket AMI isn’t recommended for use with Amazon EC2 instances with an Inferentia chip.

• Bottlerocket images don’t include an SSH server or a shell. You can employ out-of-band access methods to allow SSH. These approaches enable the admin container and to pass some bootstrapping configuration steps with user data. For more information, refer to the following sections in Bottlerocket OS on GitHub:

  • Exploration

  • Admin container

  • Kubernetes settings

• Bottlerocket uses different container types:

  • By default, a control container is enabled. This container runs the AWS Systems Manager agent that you can use to run commands or start shell sessions on Amazon EC2 Bottlerocket instances. For more information, see Setting up Session Manager in the AWS Systems Manager User Guide.

  • If an SSH key is given when creating the node group, an admin container is enabled. We recommend using the admin container only for development and testing scenarios. We don’t recommend using it for production environments. For more information, see Admin container on GitHub.

More information

For more information about using Amazon EKS optimized Bottlerocket AMIs, see the following sections:

• For details about Bottlerocket, see the Bottlerocket Documentation.

• For version information resources, see Retrieve Bottlerocket AMI version information.

• To use Bottlerocket with managed node groups, see Simplify node lifecycle with managed node groups.

• To launch self-managed Bottlerocket nodes, see Create self-managed Bottlerocket nodes.

• To retrieve the latest IDs of the Amazon EKS optimized Bottlerocket AMIs, see Retrieve recommended Bottlerocket AMI IDs.

• For details on compliance support, see Meet compliance requirements with Bottlerocket.