Container Linux by CoreOS is an open source software project that provides system administrators and experienced users with a modern and minimal operating system designed for massive server deployments. It is not based on any existing distribution of Linux and features the latest Linux kernel and Docker technologies for enabling warehouse-scale computing with minimum effort as possible.
Great availability, amazing technologies
The product is distributed as a standard ISO image, which can be burned onto a CD disc or written on a USB flash drive in order to boot it from the BIOS of a PC and install the operating system (detailed installation instructions are provided on the project's homepage).
In addition to the ISO image, which is supported on both 64-bit and 32-bit instruction set architectures, the project can also be booted over network and installed on a local disk via the PXE (Preboot Execution Environment) and iPXE implementations and boot loaders.
Furthermore, it is supported by various cloud providers, including Amazon EC2, GCE, Brightbox and Rackspace, or deployable as a virtual machine on the QEMU, VMware, OpenStack, Eucalyptus and Vagrant virtualization technologies.
Because of its modern internal design, CoreOS uses with up to 50% less RAM (system memory) than any other existing server operating system. In addition, it makes use of the award winning Docker software project to run applications as containers.
Another interesting feature is the active/passive dual-partition scheme, which will make system updates painless and fast, while providing a rollback functionality. Also, it is designed from the ground up to be clustered, even if it runs on a single machine.
Bottom line
Summing up, CoreOS is a great Linux-based operating system for massive server deployments, which can be used by top-notch Internet companies like Twitter, Facebook or Google to run their services at scale with high flexibility.
What is new in this release:
- Security fixes:
- Fix Linux remote denial of service (FragmentSmack, CVE-2018-5391)
- Fix Linux privileged memory access via speculative execution (L1TF/Foreshadow, CVE-2018-3620, CVE-2018-3646)
- Updates:
- intel-microcode 20180703
- Linux 4.14.63
What is new in version 1745.7.0:
- Fix TCP connection stalls (#2457)
What is new in version :
- Security fixes:
- Fix CPU disclosure of kernel memory to user process (CVE-2017-5754, Meltdown)
- Fix denial of service due to incorrect eBPF sign extension (CVE-2017-16995)
- Bug fixes:
- Don't fail update-ssh-keys, and thus coreos-cloudinit, on an invalid SSH key (#2283)
- Updates:
- Linux 4.14.11
What is new in version 1520.8.0:
- Security fixes:
- Fix wget overflows in HTTP protocol handling (CVE-2017-13089, CVE-2017-13090)
What is new in version 1465.7.0:
- Bug fixes:
- Fix ASAN support (#2105)
- Changes:
- Update to a new subkey for signing release images
- Updates:
- Linux 4.12.10
What is new in version 1409.8.0:
- Security fixes:
- Fix Linux heap out-of-bounds in AF_PACKET sockets (CVE-2017-1000111)
- Fix Linux exploitable memory corruption due to UDP fragmentation offload (CVE-2017-1000112)
- Updates:
- Linux 4.11.12
What is new in version 1409.6.0:
- Bug fixes:
- Fixed handling of duplicate volumes in rkt fly (#2016)
- Fixed kernel oops in 1409.2.0 with mmap(..., MAP_FIXED, ...)
What is new in version 1353.8.0:
- Security fixes:
- Fix NSS out-of-bounds write (CVE-2017-5461)
- Bug fixes:
- Fixed kubelet-wrapper leaving behind orphaned pods (#1831)
What is new in version 1353.6.0:
- Bug Fixes:
- Fixed kubelet-wrapper failures with /var/log mounted (#1892)
- Fixed containerd crashes (#1909)
- Changes:
- The coreos-metadata provider can be overridden (#1917)
- Updates:
- curl 7.54.0
- Go 1.7.5
- Linux 4.9.24
What is new in version 1298.7.0:
- Security fixes:
- Fixed local privilege escalation (CVE-2017-7184)
- Bug fixes:
- Fixed a bug where systemd would spam 'Time has been changed' messages (#1868)
- Updates:
- Linux 4.9.16
What is new in version 1298.6.0:
- Bug Fixes:
- Enabled building the ipvlan kernel module again (#1843)
- Corrected flannel configuration failures on service retries (#1847)
What is new in version 1298.5.0:
- Bug Fixes:
- Fix useradd defaults in chroots (#1787)
- Upgrades:
- Linux 4.9.9
What is new in version 1235.9.0:
- Fixed sporadic network failures in Docker containers.
What is new in version 1235.4.0:
- Fix af_packet.c race condition (CVE-2016-8655)
What is new in version 1185.3.0:
- Removed etcd-wrapper:
- The Stable channel has never contained a version which included this wrapper script and service. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the etcd-wrapper when it updates to this release.
What is new in version 1122.3.0:
- Fix privilege escalation vulnerability in Linux kernel - CVE-2016-5195 (Dirty COW)
- Fix denial of service in systemd - CVE-2016-7795
What is new in version 1122.2.0:
- Bug Fixes:
- Correct nameserver option parsing in networkd (#1456)
- Fix erroneous warning about install sections in service units (#1512)
- Fix timer execution calculation in systemd (#1516)
- Improve journald's resilience to ENOSPC errors (#1522)
- Build rkt without TEXTREL section (#1525)
- Reintroduce sdnotify-proxy (#1528)
- Changes:
- Removed etcd-wrapper
- The Stable channel has never contained a version which included this wrapper script and service. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the etcd-wrapper when it updates to this release.
- Updates:
- rkt 1.8.0 (removed on ARM64)
- The Stable channel has never contained a version which included rkt for ARM64. If an ARM64 instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose rkt when it updates to this release.
- Docker 1.10.3
What is new in version 1068.10.0:
- Fix timer assertion in systemd (#1308)
- Correct nameserver option parsing in networkd (#1456)
- Fix timer execution calculation in systemd (#1516)
- Improve journald's resilience to ENOSPC errors (#1522)
What is new in version 1068.9.0:
- Security Updates:
- libcurl 7.50.1 for CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-4802, CVE-2016-3739
What is new in version 1068.8.0:
- Security Updates:
- libpcre 8.38-r1 for CVE-2014-8964, CVE-2014-8964, CVE-2015-5073, CVE-2015-5073, CVE-2015-5073, CVE-2015-8380, CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8387, CVE-2015-8388, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8392, CVE-2015-8393, CVE-2015-8394, CVE-2015-8395, CVE-2016-1283, CVE-2016-1283
- Bug Fixes:
- Properly escape systemd specifiers (#1459)
What is new in version 1068.6.0:
- Bug Fixes:
- Fix parsing of the user database which caused systemd-sysusers to crash (#1394)
- Fix handling of certain unicode characters in bash (#1411)
- Fix issue when starting transient services (#1430)
- Include work-around for empty SSH host keys (#106)
- Changes:
- Removed Kubernetes kubelet
- The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
- Set group for /dev/kvm
- Updates:
- coreos-metadata v0.4.1
- bash 4.3_p46
What is new in version 1010.6.0:
- Linux 4.5.7 + patches for CVE-2016-4997 and CVE-2016-4998
- OpenSSH 7.2p2 for CVE-2016-3115
- dhcpcd 6.10.1 CVE-2016-1503
- libgcrypt 1.6.5 CVE-2015-7511
- rsync 3.1.1
What is new in version 1010.5.0:
- Removed Kubernetes kubelet:
- The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
What is new in version 899.17.0:
- OpenSSL 1.0.2h
- ntpd 4.2.8p7
- git 2.7.3-r1
- jq 1.5-r2
What is new in version 899.15.0:
- Fixes:
- fleet 0.11.7 (#1186)
- Fix systemd-networkd assertion failure when stopping (#1197)
What is new in version 899.13.0:
- Removed Kubernetes kubelet:
- The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
What is new in version 835.13.0:
- glibc patched for CVE-2015-1781, CVE-2014-8121, CVE-2015-8776, CVE-2015-8778, CVE-2015-8779 and CVE-2015-7547 coreos-overlay#1180
What is new in version 835.12.0:
- Update to OpenSSL 1.0.2f for CVE-2016-0701 and CVE-2015-3197 and updates CVE-2015-4000 (logjam)
What is new in version 835.10.0:
- Fix security issue in OpenSSH 6.9p1, applying the small patch recommended in the 7.1p2 release notes. CVE-2016-0777
- Fix keyring ref leak in kernel CVE-2016-0728
What is new in version 835.8.0:
- Removed Kubernetes kubelet. The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
- coreos-metadata 0.3.0
What is new in version 766.5.0:
- Bug Fixes:
- Minimize high-order allocations in OverlayFS (https://github.com/coreos/bugs/issues/489)
- Fixed issue causing journald to consume large amounts of CPU (https://github.com/coreos/bugs/issues/322)
- Removed locksmith's dependency on update-engine (https://github.com/coreos/bugs/issues/944)
What is new in version 766.4.0:
- Changes:
- Linux 4.1.7
- Bug Fixes:
- Correct systemd's handling of machine state on daemon-reload (https://github.com/coreos/bugs/issues/454)
- Fix docker0 bridge failures (https://github.com/coreos/bugs/issues/471)
What is new in version 766.3.0:
- Linux 4.1.6
- etcd 2.1.2
- coreos-install includes a new image signing GPG key which will be used starting next week.
- Ignition has been removed from the 766 release branch, for now it is only available in alpha releases.
What is new in version 723.3.0:
- Security Fixes:
- OpenSSL 1.0.1p (CVE-2015-1793)
What is new in version 681.0.0:
- Docker 1.6.2
- Linux 4.0.3
- coreos-cloudinit 1.4.1
- Use systemd-timesyncd instead of ntpd for time synchronization
- By default, systemd-timesyncd will prefer time servers provided by DHCP and fall back to coreos.pool.ntp.org
- Mount root volume read/write via kernel cmdline instead of in the initramfs
- Blacklist xen_fbfront on ec2 images
- Fixes 30s pause during boot (https://github.com/coreos/bugs/issues/208)
- Enable 3w_sas and 3w_9xxx kernel modules
- openssl 1.0.1m
- dhcpcd 6.6.7
- Updated timezone data to 2015b
What is new in version 647.2.0:
- Linux 4.0.1:
- Enable SCSI_MVSAS
What is new in version 494.3.0:
- coreos-cloudinit v0.10.9
- Temporary shim for Docker's --insecure-registry flag (https://github.com/coreos/coreos-overlay/commit/f6ae1a34d144e3476fb9c31f3c6ff7df9c18c41c)
What is new in version 444.4.0:
- fleet 0.8.3
What is new in version 367.1.0:
- Linux 3.15.2
- Docker 1.0.1
- Support on all major cloud providers, including Rackspace Cloud, Amazon EC2 (including HVM), and Google Compute Engine
- Commercial support via CoreOS Managed Linux
Comments not found