Bottlerocket

Definition

Bottlerocket is an open-source Linux-based operating system built by AWS specifically to run containers, stripping out the general-purpose tooling found in typical server distributions in favor of a minimal, immutable image dedicated to hosting a container runtime. It ships without a package manager or shell in its default configuration, updating itself by replacing the entire operating system image rather than patching individual packages.

Overview

Bottlerocket addresses a specific problem in container infrastructure: general-purpose Linux distributions carry a large surface area of packages, shells, and configuration files that container hosts do not need and that create ongoing patching burden and attack surface. Bottlerocket instead ships only what is required to run a container orchestrator's node agent and container runtime, containerd, removing SSH access and interactive shells from the primary system partition by default. Mechanically, Bottlerocket uses an image-based update model rather than a package-based one: the operating system lives on one of two alternating partitions, and updates are applied by downloading and activating a complete new image on the inactive partition, then rebooting into it. If the new image fails a health check, the system can automatically roll back to the previous partition, which removes much of the partial-upgrade failure risk that traditional package updates carry. Administrative access, when needed, happens through a separate control container or admin container that runs alongside the minimal host rather than through a shell on the host itself. The control container integrates with AWS Systems Manager so operators can start an interactive session without exposing an SSH daemon on the host, keeping the audit trail and access model consistent with the rest of an AWS-managed environment. Bottlerocket sits in the same general category as other container-optimized operating systems such as Flatcar Container Linux and Talos Linux, all of which trade general-purpose flexibility for a smaller, more predictable attack surface tailored to orchestrated container workloads. Compared to running containers on a standard Amazon Linux or Ubuntu server image, Bottlerocket removes far more of the traditional OS surface, while Talos Linux goes further still by being built exclusively for Kubernetes and managed entirely through an API rather than any host access at all. In practice, Bottlerocket is used as the node operating system for Amazon EKS and Amazon ECS clusters, particularly by teams that want to reduce the operational burden of patching individual OS packages across large fleets of container hosts and want image-based, atomic updates with automatic rollback. The trade-off is reduced flexibility: because there is no general package manager or persistent shell by design, workloads or debugging workflows that assume normal Linux server access do not transfer directly, and teams must adapt their operational tooling to work through Bottlerocket's control container model instead of traditional SSH-based administration. Debugging a misbehaving node therefore requires familiarity with that control-container workflow, which is an added step for teams used to simply logging into a server directly.

Key Features

• Minimal image containing only what is needed to run containerd and orchestrator agents
• Image-based atomic updates across two alternating partitions
• Automatic rollback to the previous partition if an update fails health checks
• No default SSH access or persistent shell on the primary host
• Separate admin and control containers for out-of-band administrative access
• Purpose-built integration with Amazon EKS and Amazon ECS
• Reduced package surface area to shrink the attack surface of container hosts

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps