Bottlerocket is a free, open-source Linux-based operating system purpose-built for hosting containers. It is designed with a strong focus on security, immutability, and reliable updates. The system is configured entirely through an API-driven settings model, with all configuration stored as key-value pairs in a filesystem datastore. It supports multiple orchestrator variants (Amazon EKS, Amazon ECS, VMware, and bare metal) and cloud platforms (AWS, VMware, bare metal), with specialized variants for NVIDIA GPUs and FIPS compliance. The architecture is a minimal, Rust-heavy OS image built via a custom build system (Twoliter). The core components include a settings datastore with serialization/deserialization, a versioned migration framework for safe upgrades/downgrades, per-variant settings plugins loaded as dynamic libraries, and a TUF-based update mechanism with A/B partition flipping. The build system produces bootable images (AMIs, OVAs, raw images) and publishes them to TUF repositories. The codebase is organized as a Cargo workspace with hundreds of small crates, each handling a specific concern (migrations, defaults, plugins, models). Key entry points include the build system (cargo make), the settings datastore library (sources/api/datastore), the migration helpers (sources/api/migration/migration-helpers), and the per-variant settings defaults (sources/settings-defaults). The repository also contains tools for local VM testing, kernel config diffing, and secure boot key generation. While the codebase is well-structured and actively maintained, it suffers from significant duplication across many similar variants (e.g., Kubernetes 1.31 through 1.37) and a large number of archived migrations, which increases maintenance burden.
LinuxKit is a toolkit for building custom, minimal, immutable Linux distributions designed to run as container-based virtual machine images. The system is primarily a Go-based CLI tool (`linuxkit`) that reads declarative YAML configurations specifying a kernel, init system, onboot containers, and long-running services. It orchestrates the assembly of these components into bootable output formats (kernel+initrd, ISO, qcow2, VHD, raw disk, etc.) using Docker/BuildKit for package building and containerd/runc as the base runtime inside the target OS. The repository also contains extensive kernel build infrastructure with support for multiple kernel series (4.x, 5.x, 6.x), including real-time (PREEMPT_RT) patches, and cloud platform integration for running images on AWS, GCP, Azure, Equinix Metal, Hyper-V, VMware, QEMU, and macOS Virtualization Framework. While the core tool is well-structured and features reusable patterns like an OCI image cache and a generic package builder, the overall codebase shows signs of maintenance slowdown (last major release v0.8 in 2020, some deprecated kernel series, and experimental projects that may be stale). It remains a solid, professionally built system for immutable OS assembly with a strong emphasis on security and reproducibility.