Azure Linux - What, Why and Where

Azure Linux Explained: A Deep Dive

Key Concepts:

• Azure Linux: Microsoft's RPM-based Linux distribution optimized for Azure services and containerized workloads.
• AKS (Azure Kubernetes Service): A managed Kubernetes service in Azure.
• RPM Package Manager: A package management system used for installation, upgrade, and maintenance of software.
• CVE (Common Vulnerabilities and Exposures): A list of publicly disclosed computer security flaws.
• Pod Sandboxing: Isolating containers within pods using lightweight virtual machines (kata containers), each with its own kernel.
• Confidential Containers: Encrypting container memory using AMD SEV-SNP technology for enhanced security.
• OS SKU: The operating system image used for creating virtual machine scale sets or node pools.
• PMC (packages.microsoft.com): The repository where Azure Linux packages are hosted.

1. What is Azure Linux?

• Azure Linux is Microsoft's own Linux distribution, based on the RPM package manager.
• It is not a fork of another distribution; it's built from the ground up by Microsoft for its specific needs.
• It follows a monthly release cycle with full security and performance testing.
• Packages are available at packages.microsoft.com (PMC).
• The source code and ISO images are available on GitHub, allowing for open-source contributions and custom builds.

2. Why Did Microsoft Create Azure Linux?

• Many Microsoft services (Azure, Xbox, M365, Defender) rely on Linux.
• Previously, different teams used different Linux distributions, leading to inconsistent security, management, and compliance practices.
• Azure Linux provides a centralized, standardized Linux distribution focused on security, performance, quality, and support for Microsoft's first-party services.
• It's part of Microsoft's core security initiative and standardization efforts.
• Any new first-party service requiring Linux will use Azure Linux.

3. Where Can You Use Azure Linux Today?

• Currently, its primary supported use case is AKS (Azure Kubernetes Service).
• When creating AKS node pools, you can choose Azure Linux as the OS SKU.
• Migrating from Ubuntu to Azure Linux in AKS is simplified using the OS SKU migration feature, which adds new Azure Linux nodes and gradually replaces existing ones without losing capacity.
• The AKS control plane always runs on Azure Linux, regardless of the node pool OS.
• Azure Linux-based container images are published for Node.js and OpenJDK.
• While not officially supported, you can download the ISO and run it as an Azure VM or on bare metal.

4. Benefits of Using Azure Linux in AKS

• Designed for Purpose: Azure Linux is specifically designed for containerized workloads and Microsoft services, unlike general-purpose distributions.
• Reduced Package Count: The number of packages is significantly reduced (around 520 compared to 720 in a regular distribution), minimizing the attack surface and potential vulnerabilities. Unnecessary packages with a rich CVE history have been removed.
• Performance Improvements: Fewer packages lead to less overhead and a smaller footprint, resulting in faster cluster creation, upgrades, and pod start times in AKS. CRUD (Create, Read, Update, Delete) operations also run faster.
• Resilience:
  • Thorough testing between Azure Linux and AKS teams ensures that updates don't negatively impact AKS functionality.
  • Any Azure Linux package update triggers a full end-to-end test suite for AKS.
  • Major Azure Linux versions (e.g., 3.0) avoid changing critical components like the kernel, containerd, and systemd to minimize regression problems. Security fixes are backported.
• Additional Capabilities:
  • Pod Sandboxing: Isolates containers within pods using lightweight virtual machines (kata containers), each with its own kernel (Azure Linux), providing enhanced security and isolation.
  • Confidential Containers: Builds on pod sandboxing by encrypting container memory using AMD SEV-SNP technology, providing encryption in use for regulatory compliance or enhanced security.
  • AKS Automatic: Automatically provisions users, systems, and node pools.

5. Key Considerations

• While using Azure Linux as the container host, container images can still be based on other Linux distributions (e.g., Ubuntu).
• Azure Linux is designed to work with various third-party software solutions and open-source tools.
• FIPS and trusted launch versions of Azure Linux are available.
• A100 and H100 Nvidia GPU SKUs are not currently supported on Azure Linux (but are on the roadmap).

6. Conclusion

Azure Linux is a purpose-built Linux distribution optimized for Microsoft's Azure services and containerized workloads, particularly AKS. Its focus on security, performance, and resilience, along with additional features like pod sandboxing and confidential containers, makes it a compelling choice for organizations using AKS. The tight integration and thorough testing between Azure Linux and AKS provide a more reliable and performant platform compared to general-purpose Linux distributions. The presenter expects the use cases for Azure Linux to expand over time.