Thilo Fromm

Running an up-to-date and fully patched cluster is a key element in operational security. But keeping your cluster’s OS up to date can be challenging for ops/maintenance, sometimes imposing significant effort just to keep the lights on while at the same time keep the workloads functioning. This talk will briefly introduce the atomic OS update mechanism in Flatcar Container Linux - a minimal Linux distribution optimised for running containers at scale - before elaborating on common patterns we recommend and employ to make updating nodes and clusters a low-risk and automatable endeavor.

This talk will discuss common patterns for patching and updating nodes and clusters, focusing on container operating systems with atomic update capabilities – and Flatcar Container Linux in particular. To some extend these patterns and learnings can also be applied to traditional OSes. Target audience are operators and engineers interested in keeping their clusters’ OS updated while running workloads at scale.

The advent and widespread use of containers to deploy applications helped a great deal to separate application workloads from the underlying operating system. This separation can be leveraged to make OS updates safe and unintrusive.

For the purposes of this talk we will focus on Flatcar Container Linux, though settings, patterns, and components can be generalised to also apply to other distributions. After w brief overview of Flatcar’s update process, we’ll discuss the importance of testing (with a brief excursion into canaries) and dive into a number of common cluster scenarios and how to keep one’s OS fresh in the respective environment.

Flatcar Container Linux is a fully open source, minimal-footprint, secure by default and always up-to-date Linux distribution for running containers at scale. It is shipped as an image and does not include any package management. OS binaries and libraries reside on a read-only partition. This talk will briefly introduce Flatcar’s core concepts before diving into a detailed discussion on modifying, testing, and vending your own OS images using the SDK.

This talk will discuss building, modifying, and testing Flatcar Container Linux OS images. It will introduce the innerworks of the OS image building process and will enable the audience to craft their own images. While running (release-)tests will also be briefly covered the focus is on modifying and building. Target audience are engineers and tinkerers interested in OS building and in vending immutable OS images that fit their own needs.

Flatcar Container Linux is a minimal Linux distribution optimised for running containers at scale. It ships OS images – both for installation and update – and lacks a package manager. Binaries in the OS partition (at “/usr”) are immutable after installation. Therefore, modifying the OS to suit one’s needs can be challenging, and deeper changes to the OS will require vending one’s own images.

After a brief intro to Flatcar’s Gentoo roots, build process, and SDK, this talk will dive into understanding sources and repository structure, running builds, smoke-testing custom images, and running full-blown release tests. We will include a number of pre-recorded CLI demos in the talk to aid understanding. The talk will close with an outlook of how to bring your custom images to production.