Bottlerocket is a free, open-source Linux-based operating system purpose-built for hosting containers. It is designed with a strong focus on security, immutability, and reliable updates. The system is configured entirely through an API-driven settings model, with all configuration stored as key-value pairs in a filesystem datastore. It supports multiple orchestrator variants (Amazon EKS, Amazon ECS, VMware, and bare metal) and cloud platforms (AWS, VMware, bare metal), with specialized variants for NVIDIA GPUs and FIPS compliance. The architecture is a minimal, Rust-heavy OS image built via a custom build system (Twoliter). The core components include a settings datastore with serialization/deserialization, a versioned migration framework for safe upgrades/downgrades, per-variant settings plugins loaded as dynamic libraries, and a TUF-based update mechanism with A/B partition flipping. The build system produces bootable images (AMIs, OVAs, raw images) and publishes them to TUF repositories. The codebase is organized as a Cargo workspace with hundreds of small crates, each handling a specific concern (migrations, defaults, plugins, models). Key entry points include the build system (cargo make), the settings datastore library (sources/api/datastore), the migration helpers (sources/api/migration/migration-helpers), and the per-variant settings defaults (sources/settings-defaults). The repository also contains tools for local VM testing, kernel config diffing, and secure boot key generation. While the codebase is well-structured and actively maintained, it suffers from significant duplication across many similar variants (e.g., Kubernetes 1.31 through 1.37) and a large number of archived migrations, which increases maintenance burden.