Pre-release Note

This is the latest Bottlerocket release, and is currently being made available.
You may notice nodes upgrading to this new version, though it may not yet be available globally until the "pre-release" flag is removed.

Release Highlights

• Remove aws-k8s-1.28 variants (#4717)
• Disable concurrent layer fetch by default in containerd-2.1 (bottlerocket-core-kit#764)

OS Changes

• Update bottlerocket-kernel-kit from 4.5.1 to 4.7.0 CHANGELOG (commits) (#4719)
• Update bottlerocket-core-kit from 11.0.1 to 12.0.1 CHANGELOG (commits) (#4719, #4724)
• Update admin-container from 0.12.4 to 0.12.5 CHANGELOG (commits) (#4712)
• Update bootstrap-container from 0.2.8 to 0.2.9 CHANGELOG (commits) (#4712)
• Update control-container from 0.8.10 to 0.8.11 CHANGELOG (commits) (#4712)
• Update aws-dev and vmware-dev variants with the latest Bottlerocket features(#4705)

Build Changes

• Update bottlerocket-sdk from 0.65.1 to 0.66.0 (commits) (#4719)

Twoliter

• Update twoliter from v0.13.0 to v0.15.0 CHANGELOG (commits)(#4718, #4722)

Release Highlights

• New ecs-3 variants are now available as a preview (#4685)
  • Add aws-ecs-3, aws-ecs-3-nvidia, aws-ecs-3-fips, and aws-ecs-3-nvidia-fips variants
  • All ecs-3 variants use the following:
    • kernel-6.12
    • containerd-2.1
    • systemd-257
    • nftables
    • whippet (bottlerocket-core-kit#720)
    • docker-engine-29 (bottlerocket-core-kit#711)
    • docker-cli-29 (bottlerocket-core-kit#711)
  • Use EROFS for root filesystem
  • Use EBS volume gp3 for all variants
  • Require IMDSv2 by default
  • aws-ecs-3-nvidia and aws-ecs-nvidia-fips variants use NVIDIA R580 drivers
  • Enable support for image verification
  • Enable support for encrypted storage
• Add NVIDIA FIPS variants for Kubernetes 1.29-1.34 and ECS-2 (#4671)
• Add support for new Kubernetes settings, image-minimum-gc-age, image-maximum-gc-age, max-parallel-image-pulls, ids-per-pod, and Beta options for cpu-manager-policy-options (#4690, bottlerocket-core-kit#689)

OS Changes

• Update bottlerocket-kernel-kit from 4.4.2 to 4.5.1 CHANGELOG (commits) (#4693, #4698)
• Update bottlerocket-core-kit from 10.9.0 to 11.0.1 CHANGELOG (commits) (#4699)
• Bump containerd from 2.0 to 2.1 on all aws-k8s-1.33 variants (#4687)
• Drop socat from aws-dev variant (#4699)
• Update ECR credential provider image patterns to include EUSC image formats (#4689)
• Use whippet in aws-ecs-2, aws-k8s-1.34, and vmware-k8s-1.34 variants (#4701)

Twoliter

• Update twoliter from v0.12.0 to v0.13.0 CHANGELOG (commits) (#4691)

Settings Extensions

• Update bottlerocket-settings-models to v0.17.0 (#4690)

Release Highlights

• Add support for new kubernetes setting kube-reserved.pid and system-reserved.pid (#4661, bottlerocket-core-kit#646)
• Allow multiple sequential calls of apiclient ephemeral-storage bind (bottlerocket-core-kit#679)
• Patch containerd-2.1 to fix image pull when range-get is ignored by the registry (bottlerocket-core-kit#702)

Security Fixes

• Patch runc to mitigate CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 (bottlerocket-core-kit#6e3d3e2e)

OS Changes

• Update bottlerocket-sdk from 0.64.0 to 0.65.1 (commits)(#4664, #4667)
• Update bottlerocket-kernel-kit from 4.3.3 to 4.4.2 CHANGELOG (commits) (#4664, #4667, #4672)
• Update bottlerocket-core-kit from 10.6.0 to 10.9.0 CHANGELOG (commits) (#4661, #4664, #4667, #07b40823)
• Update admin-container from 0.12.3 to 0.12.4 CHANGELOG (commits) (#4669)
• Update bootstrap-container from 0.2.6 to 0.2.8 CHANGELOG (commits) (#4664, #4669)
• Update control-container from 0.8.8 to 0.8.10 CHANGELOG (commits) (#4664, #4669)

Settings Extensions

• Update bottlerocket-settings-models to v0.16.0 (#4661)

OS Changes

• Update bottlerocket-kernel-kit from 4.3.1 to 4.3.3 CHANGELOG (commits) (#4657)

Release Highlights

• Support passing arguments to apiclient exec subcommand with a -- separator (bottlerocket-core-kit#647)
• Install driverdog for all variants (bottlerocket-core-kit#656) - Thanks @fletcherw!

OS Changes

• Update bottlerocket-kernel-kit from 4.3.0 to 4.3.1 CHANGELOG (commits) (#4644)
• Update bottlerocket-core-kit from 10.4.1 to 10.6.0 CHANGELOG (commits) (#4649)
• Update admin-container from 0.12.2 to 0.12.3 CHANGELOG (commits) (#4647)
• Update bootstrap-container from 0.2.5 to 0.2.6 CHANGELOG (commits) (#4647)
• Update control-container from 0.8.7 to 0.8.8 CHANGELOG (commits) (#4647)

Release Highlights

• Add new kubernetes 1.34 variants (#4631):
  • Add aws-k8s-1.34, aws-k8s-1.34-nvidia, aws-k8s-1.34-fips, vmware-k8s-1.34, and vmware-k8s-1.34-fips variants
  • All k8s-1.34 variants use the following:
    • Kernel 6.12
    • systemd-257 (bottlerocket-core-kit#581, bottlerocket-core-kit#636)
    • nftables for managing network filter rules (bottlerocket-core-kit#549)
    • containerd-2.1 (bottlerocket-core-kit#621)
      • Default concurrent-download-chunk-size setting is set at 8mib
      • Remove the support for Schema 1 images
    • Update defaults for the shutdown-grace-period to 2 minutes and 30 seconds with the last 30 seconds reserved for critical pods for aws variants.
  • Default device list strategy is set to cdi-cri for nvidia k8s device plugin
  • aws-k8s-1.34-nvidia variant uses NVIDIA R580 drivers
• Add command field to override default entrypoint for host and bootstrap containers (#4636, bottlerocket-core-kit#594) - Thanks @kasimeka!
• Add containerd-2.1 setting for concurrent-download-chunk-size (#4638, bottlerocket-core-kit#645)

OS Changes

• Update bottlerocket-kernel-kit from 4.2.0 to 4.3.0 CHANGELOG (commits) (#4637)
• Update bottlerocket-core-kit from 10.3.0 to 10.4.1 CHANGELOG (commits) (#4639, #4642)

Release Highlights

• Add support for new Kubernetes setting static-pods-enabled (bottlerocket-core-kit#641)
• Add default bind directories for ephemeral storage (bottlerocket-core-kit#632)

OS Changes

• Update bottlerocket-sdk from 0.63.0 to 0.64.0 (commits)(#4623)
• Update bottlerocket-core-kit from 10.1.2 to 10.3.0 CHANGELOG (commits) (#4623, #4628)
• Update bottlerocket-kernel-kit from 4.0.1 to 4.2.0 CHANGELOG (commits) (#4623, #4626)

Build Changes

Twoliter

• Update twoliter from 0.11.0 to 0.12.0 and schema-version to 2 CHANGELOG (commits) (#4624)

Release Highlights

• Fix containerd-2.0 settings for max_concurrent_downloads (bottlerocket-core-kit#623)

OS Changes

• Restrict kubelet's exec-start file permission to 0600 (#4574)
• Restrict kubelet-server.key file permission to 0600 (#4599)
• Update admin container from 0.12.1 to 0.12.2 CHANGELOG (commits) (#4612)
• Update bootstrap container from 0.2.4 to 0.2.5 CHANGELOG (commits) (#4612)
• Update control container from 0.8.6 to 0.8.7 CHANGELOG (commits) (#4612)
• Update bottlerocket-kernel-kit from 3.3.1 to 4.0.1 CHANGELOG (commits)(#4613)
• Update bottlerocket-core-kit from 10.0.1 to 10.1.2 CHANGELOG (commits)(#4615, #4616, #4619)

Release Highlights

• Remove aws-k8s-1.27 and aws-ecs-1 variants (#4598)
• Fix file descriptor leak in apiserver exec (bottlerocket-core-kit#595)
• Add soci-snapshotter support to kubernetes variants (#4593)
  • Configure soci-snapshotter for parallel pull unpack feature (bottlerocket-core-kit#569)
  • Optionally configure containerd and kubelet with soci-snapshotter via drop-in configuration files (bottlerocket-core-kit#576)
  • Extend selinux-policy to cover soci-snapshotter (bottlerocket-core-kit#579)
  • Add configure-snapshotter.service to reset state directories of snapshotters on boot when selected snapshotter changes (bottlerocket-core-kit#582)
  • Apply upstream patches to soci-snapshotter (bottlerocket-core-kit#599)
  • Drop CLI from soci-snapshotter (bottlerocket-core-kit#569)

OS Changes

• Update bottlerocket-core-kit from 9.2.1 to 10.0.1 CHANGELOG (commits) (#4605, #4609)
• Update bottlerocket-kernel-kit from 3.2.1 to 3.3.1 CHANGELOG (commits) (#4604)

Build Changes

• Add reset-single-test testsys command (#4581)

Orchestrator Changes

Kubernetes

• Add soci-snapshotter support to kubernetes variants (#4593)
• Remove aws-k8s-1.27 variants (#4598)

ECS

• Remove aws-ecs-1 variants (#4598)

OS Changes

• Update bottlerocket-core-kit from 9.1.0 to 9.2.1 (commits)(#dee811f6)
• Update bottlerocket-kernel-kit from 3.1.1 to 3.2.1 (commits)(#d6d31d6c)
• Update admin container from 0.12.0 to 0.12.1 CHANGELOG (commits) (#4590)
• Update bootstrap container from 0.2.3 to 0.2.4 CHANGELOG (commits) (#4590)
• Update control container from 0.8.5 to 0.8.6 CHANGELOG (commits) (#4590)

Build Changes

• Update bottlerocket-sdk from 0.62.0 to 0.63.0 (commits) (#4592)

Twoliter

• Update twoliter from 0.10.1 to 0.11.0 CHANGELOG (commits) (#4594)