Security on Flatcar Container Linux

About the handling of embargoed security issues

Mon, 07 Nov 2022 14:00:00 +0200

TL; DR: Flatcar is safe against recent OpenSSL vulnerabilities

With the recent OpenSSL vulnerabilities CVE-2022-3786 and CVE-2022-3602 , the Flatcar team has provided as soon as possible a batch of releases for impacted Flatcar channels (all except LTS which is not impacted). Releases have been published within one hour after the official public announcement and users were able to secure their workloads almost immediately without unexpected turbulences as the releases included only minimal changes to address the security issues.

OpenSSL-3.0.0 on Flatcar: what to expect?

Wed, 27 Oct 2021 20:00:00 +0200

In the Open-Source Software ecosystem, actions often start with an opened issue. In this journey, it was the flatcar-linux/Flatcar#418 - but before talking about OpenSSL-3.0 on Flatcar, let’s take two steps back.

TL; DR: Let’s upgrade to OpenSSL v3 for a whole operating system and spoiler alert, the issue was misleading: almost nothing broke.

Flatcar Container Linux (FCL) is an open-source Linux distro, optimized to run container workloads and based on Gentoo. One particularity of FCL is the lack of package manager: it’s not possible to install softwares with tools like emerge, pacman or yum - this design ensures reproducibility and security. It’s the responsibility of the community and the FCL core maintainers to manage the lifecycle of packages: from selection to the upgrades and applying FCL patches.

Using eBPF in Flatcar Container Linux

Thu, 22 Apr 2021 10:00:00 +0200

Extended Berkeley Packet Filter (eBPF) is a core Linux technology with multiple applications in different computer domains like security, networking and tracing. For the containers and Kubernetes specific case, it’s used with networking projects like Cilium or Calico, debugging solutions like BCC, kubectl-trace and Inspektor Gadget, and security-related projects like tracee and Falco.

eBPF is a very fast evolving technology: each new kernel release includes new features, and different Linux distributions rush to enable them for their users. Flatcar Container Linux is no exception, and in this blog post I cover the new eBPF features that we have enabled in the lastest Flatcar versions and why they are important.