TLDR Tech / InfoSec
Hands On with AWS Bottlerocket: Evaluating the Security of Amazon's Hardened OS
AWS Bottlerocket is a hardened OS designed for running Kubernetes nodes that includes several layers of protection, such as a read-only root filesystem, an always-enabled, restrictive SELinux profile, no package managers, language interpreters, or command shells, as well as removing many other common privilege escalation tools. This article compares an Ubuntu node and a Bottlerocket node with three common container escape techniques and found that Bottlerocket prevented all three of them, while they all succeeded on the Ubuntu node.
Read the full story