Bottlerocket — Container-Optimized Linux OS by AWS

What it is

Bottlerocket is a minimal Linux distribution built by AWS specifically for running containers. It reduces the attack surface with an immutable root filesystem, removes unnecessary packages (no shell by default, no package manager), and provides automatic updates with rollback support.

Bottlerocket targets teams running containers on EKS, ECS, or bare metal who want a hardened, low-maintenance host OS. Configuration is done through an API rather than SSH, aligning with infrastructure-as-code practices.

How it saves time or tokens

Traditional container hosts run full Linux distributions (Ubuntu, Amazon Linux) with thousands of packages that need patching. Bottlerocket includes only what containers need, reducing the number of CVEs to track and patch. Automatic updates happen atomically with rollback, eliminating manual OS maintenance.

The API-driven configuration means no SSH sessions, no Ansible playbooks for OS-level settings -- just API calls or user-data at boot.

How to use

1. Launch Bottlerocket on AWS EKS:

aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/bottlerocket/aws-k8s-1.29/x86_64/latest/image_id \
  --instance-type m5.large \
  --key-name my-key \
  --user-data file://config.toml

1. Configure via TOML user-data:

[settings.kubernetes]
cluster-name = "my-cluster"
api-server = "https://my-eks-endpoint.amazonaws.com"
cluster-certificate = "base64-cert..."

1. Nodes join the EKS cluster automatically. No SSH needed for normal operations.

Example

# Check Bottlerocket version via the admin container
# (debug access, disabled by default)
enter-admin-container

apiclient get settings.kubernetes
# Returns cluster configuration

apiclient set settings.ntp.time-servers='["169.254.169.123"]'
# Changes NTP settings via API

# Trigger an update
apiclient update check
apiclient update apply

EKS managed node group with Bottlerocket:

eksctl create nodegroup \
  --cluster my-cluster \
  --node-ami-family Bottlerocket \
  --nodes 3

Related on TokRepo

• AI Tools for DevOps -- Container and infrastructure management tools
• AI Tools for Security -- Security-focused infrastructure tools

Common pitfalls

• Bottlerocket has no shell or package manager by default. If you need to debug, enable the admin container explicitly. This is by design for security.
• Not all EKS add-ons or DaemonSets work out of the box on Bottlerocket. Test your observability and networking agents before rolling out.
• Bottlerocket updates are atomic. If an update fails, the system rolls back to the previous version. Monitor update status via the API.