Pre-release Note

This is the latest Bottlerocket release, and is currently being made available.
You may notice nodes upgrading to this new version, though it may not yet be available globally until the "pre-release" flag is removed.

Release Highlights

• Removeaws-k8s-1.28 variants (#4717)
• Disable concurrent layer fetch by default incontainerd-2.1 (bottlerocket-core-kit#764)

OS Changes

• Updatebottlerocket-kernel-kit from 4.5.1 to 4.7.0CHANGELOG (commits) (#4719)
• Updatebottlerocket-core-kit from 11.0.1 to 12.0.1CHANGELOG (commits) (#4719,#4724)
• Updateadmin-container from 0.12.4 to 0.12.5CHANGELOG (commits) (#4712)
• Updatebootstrap-container from 0.2.8 to 0.2.9CHANGELOG (commits) (#4712)
• Updatecontrol-container from 0.8.10 to 0.8.11CHANGELOG (commits) (#4712)
• Updateaws-dev andvmware-dev variants with the latest Bottlerocket features(#4705)

Build Changes

• Updatebottlerocket-sdk from 0.65.1 to 0.66.0 (commits) (#4719)

Twoliter

• Updatetwoliter from v0.13.0 to v0.15.0CHANGELOG (commits)(#4718,#4722)

Release Highlights

• New ecs-3 variants are now available as a preview (#4685)
  • Addaws-ecs-3,aws-ecs-3-nvidia,aws-ecs-3-fips, andaws-ecs-3-nvidia-fips variants
  • All ecs-3 variants use the following:
    • kernel-6.12
    • containerd-2.1
    • systemd-257
    • nftables
    • whippet (bottlerocket-core-kit#720)
    • docker-engine-29 (bottlerocket-core-kit#711)
    • docker-cli-29 (bottlerocket-core-kit#711)
  • Use EROFS for root filesystem
  • Use EBS volume gp3 for all variants
  • Require IMDSv2 by default
  • aws-ecs-3-nvidia andaws-ecs-nvidia-fips variants use NVIDIA R580 drivers
  • Enable support for image verification
  • Enable support for encrypted storage
• Add NVIDIA FIPS variants for Kubernetes 1.29-1.34 and ECS-2 (#4671)
• Add support for new Kubernetes settings,image-minimum-gc-age,image-maximum-gc-age,max-parallel-image-pulls,ids-per-pod, and Beta options forcpu-manager-policy-options (#4690,bottlerocket-core-kit#689)

OS Changes

• Updatebottlerocket-kernel-kit from 4.4.2 to 4.5.1CHANGELOG (commits) (#4693,#4698)
• Updatebottlerocket-core-kit from 10.9.0 to 11.0.1CHANGELOG (commits) (#4699)
• Bumpcontainerd from 2.0 to 2.1 on allaws-k8s-1.33 variants (#4687)
• Dropsocat fromaws-dev variant (#4699)
• Update ECR credential provider image patterns to include EUSC image formats (#4689)
• Usewhippet inaws-ecs-2,aws-k8s-1.34, andvmware-k8s-1.34 variants (#4701)

Twoliter

• Updatetwoliter from v0.12.0 to v0.13.0CHANGELOG (commits) (#4691)

Settings Extensions

• Updatebottlerocket-settings-models to v0.17.0 (#4690)

Release Highlights

• Add support for new kubernetes settingkube-reserved.pid andsystem-reserved.pid (#4661,bottlerocket-core-kit#646)
• Allow multiple sequential calls ofapiclient ephemeral-storage bind (bottlerocket-core-kit#679)
• Patchcontainerd-2.1 to fix image pull when range-get is ignored by the registry (bottlerocket-core-kit#702)

Security Fixes

• Patchrunc to mitigateCVE-2025-31133,CVE-2025-52565, andCVE-2025-52881 (bottlerocket-core-kit#6e3d3e2e)

OS Changes

• Updatebottlerocket-sdk from 0.64.0 to 0.65.1 (commits)(#4664,#4667)
• Updatebottlerocket-kernel-kit from 4.3.3 to 4.4.2CHANGELOG (commits) (#4664,#4667,#4672)
• Updatebottlerocket-core-kit from 10.6.0 to 10.9.0CHANGELOG (commits) (#4661,#4664,#4667,#07b40823)
• Updateadmin-container from 0.12.3 to 0.12.4CHANGELOG (commits) (#4669)
• Updatebootstrap-container from 0.2.6 to 0.2.8CHANGELOG (commits) (#4664,#4669)
• Updatecontrol-container from 0.8.8 to 0.8.10CHANGELOG (commits) (#4664,#4669)

Settings Extensions

• Update bottlerocket-settings-models to v0.16.0 (#4661)

OS Changes

• Updatebottlerocket-kernel-kit from 4.3.1 to 4.3.3CHANGELOG (commits) (#4657)

Release Highlights

• Support passing arguments toapiclient exec subcommand with a-- separator (bottlerocket-core-kit#647)
• Installdriverdog for all variants (bottlerocket-core-kit#656) - Thanks@fletcherw!

OS Changes

• Updatebottlerocket-kernel-kit from 4.3.0 to 4.3.1CHANGELOG (commits) (#4644)
• Updatebottlerocket-core-kit from 10.4.1 to 10.6.0CHANGELOG (commits) (#4649)
• Updateadmin-container from 0.12.2 to 0.12.3CHANGELOG (commits) (#4647)
• Updatebootstrap-container from 0.2.5 to 0.2.6CHANGELOG (commits) (#4647)
• Updatecontrol-container from 0.8.7 to 0.8.8CHANGELOG (commits) (#4647)

Contributors

Release Highlights

• Add new kubernetes 1.34 variants (#4631):
  • Addaws-k8s-1.34,aws-k8s-1.34-nvidia,aws-k8s-1.34-fips,vmware-k8s-1.34, andvmware-k8s-1.34-fips variants
  • All k8s-1.34 variants use the following:
    • Kernel 6.12
    • systemd-257 (bottlerocket-core-kit#581,bottlerocket-core-kit#636)
    • nftables for managing network filter rules (bottlerocket-core-kit#549)
    • containerd-2.1 (bottlerocket-core-kit#621)
      • Defaultconcurrent-download-chunk-size setting is set at8mib
      • Remove the support for Schema 1 images
    • Update defaults for theshutdown-grace-period to 2 minutes and 30 seconds with the last 30 seconds reserved for critical pods for aws variants.
  • Default device list strategy is set tocdi-cri for nvidia k8s device plugin
  • aws-k8s-1.34-nvidia variant uses NVIDIA R580 drivers
• Addcommand field to override default entrypoint for host and bootstrap containers (#4636,bottlerocket-core-kit#594) - Thanks@kasimeka!
• Addcontainerd-2.1 setting forconcurrent-download-chunk-size (#4638,bottlerocket-core-kit#645)

OS Changes

• Updatebottlerocket-kernel-kit from 4.2.0 to 4.3.0CHANGELOG (commits) (#4637)
• Updatebottlerocket-core-kit from 10.3.0 to 10.4.1CHANGELOG (commits) (#4639,#4642)

Contributors

Release Highlights

• Add support for new Kubernetes settingstatic-pods-enabled (bottlerocket-core-kit#641)
• Add default bind directories for ephemeral storage (bottlerocket-core-kit#632)

OS Changes

• Updatebottlerocket-sdk from 0.63.0 to 0.64.0 (commits)(#4623)
• Updatebottlerocket-core-kit from 10.1.2 to 10.3.0CHANGELOG (commits) (#4623,#4628)
• Updatebottlerocket-kernel-kit from 4.0.1 to 4.2.0CHANGELOG (commits) (#4623,#4626)

Build Changes

Twoliter

• Updatetwoliter from 0.11.0 to 0.12.0 and schema-version to 2CHANGELOG (commits) (#4624)

Release Highlights

• Fixcontainerd-2.0 settings formax_concurrent_downloads (bottlerocket-core-kit#623)

OS Changes

• Restrict kubelet's exec-start file permission to 0600 (#4574)
• Restrict kubelet-server.key file permission to 0600 (#4599)
• Update admin container from 0.12.1 to 0.12.2CHANGELOG (commits) (#4612)
• Update bootstrap container from 0.2.4 to 0.2.5CHANGELOG (commits) (#4612)
• Update control container from 0.8.6 to 0.8.7CHANGELOG (commits) (#4612)
• Updatebottlerocket-kernel-kit from 3.3.1 to 4.0.1CHANGELOG (commits)(#4613)
• Updatebottlerocket-core-kit from 10.0.1 to 10.1.2CHANGELOG (commits)(#4615,#4616,#4619)

Release Highlights

• Removeaws-k8s-1.27 andaws-ecs-1 variants (#4598)
• Fix file descriptor leak inapiserver exec (bottlerocket-core-kit#595)
• Addsoci-snapshotter support to kubernetes variants (#4593)
  • Configuresoci-snapshotter for parallel pull unpack feature (bottlerocket-core-kit#569)
  • Optionally configure containerd and kubelet withsoci-snapshotter via drop-in configuration files (bottlerocket-core-kit#576)
  • Extend selinux-policy to coversoci-snapshotter (bottlerocket-core-kit#579)
  • Addconfigure-snapshotter.service to reset state directories of snapshotters on boot when selected snapshotter changes (bottlerocket-core-kit#582)
  • Apply upstream patches tosoci-snapshotter (bottlerocket-core-kit#599)
  • Drop CLI fromsoci-snapshotter (bottlerocket-core-kit#569)

OS Changes

• Updatebottlerocket-core-kit from 9.2.1 to 10.0.1CHANGELOG (commits) (#4605,#4609)
• Updatebottlerocket-kernel-kit from 3.2.1 to 3.3.1CHANGELOG (commits) (#4604)

Build Changes

• Addreset-single-test testsys command (#4581)

Orchestrator Changes

Kubernetes

• Addsoci-snapshotter support to kubernetes variants (#4593)
• Removeaws-k8s-1.27 variants (#4598)

ECS

• Removeaws-ecs-1 variants (#4598)

OS Changes

• Updatebottlerocket-core-kit from 9.1.0 to 9.2.1 (commits)(#dee811f6)
• Updatebottlerocket-kernel-kit from 3.1.1 to 3.2.1 (commits)(#d6d31d6c)
• Update admin container from 0.12.0 to 0.12.1CHANGELOG (commits) (#4590)
• Update bootstrap container from 0.2.3 to 0.2.4CHANGELOG (commits) (#4590)
• Update control container from 0.8.5 to 0.8.6CHANGELOG (commits) (#4590)

Build Changes

• Updatebottlerocket-sdk from 0.62.0 to 0.63.0 (commits) (#4592)

Twoliter

• Updatetwoliter from 0.10.1 to 0.11.0CHANGELOG (commits) (#4594)