Running Flatcar Container Linux on AWS EC2
The current AMIs for all Flatcar Container Linux channels and EC2 regions are listed below and updated frequently. Using CloudFormation is the easiest way to launch a cluster, but it is also possible to follow the manual steps at the end of the article. Questions can be directed to the Flatcar Container Linux IRC channel or user mailing list .
Release retention time
After publishing, releases will remain available as public AMIs on AWS for 9 months. AMIs older than 9 months will be un-published in regular garbage collection sweeps. Please note that this will not impact existing AWS instances that use those releases. However, deploying new instances (e.g. in autoscaling groups pinned to a specific AMI) will not be possible after the AMI was un-published.
Choosing a channel
Flatcar Container Linux is designed to be updated automatically with different schedules per channel. You can disable this feature , although we don’t recommend it. Read the release notes for specific features and bug fixes.
The Alpha channel closely tracks master and is released frequently. The newest versions of system libraries and utilities will be available for testing. The current version is Flatcar Container Linux 2823.0.0.
View as json feed: amd64 arm64The Beta channel consists of promoted Alpha releases. The current version is Flatcar Container Linux 2801.1.0.
View as json feed: amd64| EC2 Region | AMI Type | AMI ID | CloudFormation |
|---|---|---|---|
| ap-east-1 | HVM (amd64) | ami-050082ec2c22e87cf |
|
| ap-northeast-1 | HVM (amd64) | ami-02c27bc75b958240a |
|
| ap-northeast-2 | HVM (amd64) | ami-083cb9a61bfb4f062 |
|
| ap-south-1 | HVM (amd64) | ami-0542dfb93e9379b64 |
|
| ap-southeast-1 | HVM (amd64) | ami-04a453c1c047137a9 |
|
| ap-southeast-2 | HVM (amd64) | ami-0aa90e09ab533a108 |
|
| ca-central-1 | HVM (amd64) | ami-087ef3bb194599dd1 |
|
| eu-central-1 | HVM (amd64) | ami-063baa00344fdfb6f |
|
| eu-north-1 | HVM (amd64) | ami-0ac0b64853c77a577 |
|
| eu-west-1 | HVM (amd64) | ami-0f94787d6477e8c4e |
|
| eu-west-2 | HVM (amd64) | ami-055556a2509b0e6b8 |
|
| eu-west-3 | HVM (amd64) | ami-0059b5118f51fa6c6 |
|
| me-south-1 | HVM (amd64) | ami-054e5a169d6691e94 |
|
| sa-east-1 | HVM (amd64) | ami-05412186ee670f459 |
|
| us-east-1 | HVM (amd64) | ami-06818eed0078b0fb6 |
|
| us-east-2 | HVM (amd64) | ami-004715aa694a5e678 |
|
| us-west-1 | HVM (amd64) | ami-0b237a917b61da91f |
|
| us-west-2 | HVM (amd64) | ami-017338dca9b507964 |
|
The Edge channel includes bleeding-edge features with the newest versions of the Linux kernel, systemd and other core packages. Can be highly unstable. The current version is Flatcar Container Linux 2466.99.0.
The Stable channel should be used by production clusters. Versions of Flatcar Container Linux are battle-tested within the Beta and Alpha channels before being promoted. The current version is Flatcar Container Linux 2765.2.2.
View as json feed: amd64| EC2 Region | AMI Type | AMI ID | CloudFormation |
|---|---|---|---|
| ap-east-1 | HVM (amd64) | ami-08143d3c2b4edd3de |
|
| ap-northeast-1 | HVM (amd64) | ami-0795df04242f10569 |
|
| ap-northeast-2 | HVM (amd64) | ami-0cd250e377f035e38 |
|
| ap-south-1 | HVM (amd64) | ami-092ef496893d0b2c7 |
|
| ap-southeast-1 | HVM (amd64) | ami-0b1bdba8af4f2e2d6 |
|
| ap-southeast-2 | HVM (amd64) | ami-036913e1339e2b7d4 |
|
| ca-central-1 | HVM (amd64) | ami-0e6df7ef58fcfaa5d |
|
| eu-central-1 | HVM (amd64) | ami-03c52ea5d6f9f7d37 |
|
| eu-north-1 | HVM (amd64) | ami-0359c8b88220e81f2 |
|
| eu-west-1 | HVM (amd64) | ami-023c3f828f1f53d52 |
|
| eu-west-2 | HVM (amd64) | ami-0551d1417af39acc9 |
|
| eu-west-3 | HVM (amd64) | ami-0c15b62ee506279a5 |
|
| me-south-1 | HVM (amd64) | ami-0ecc8f9014468b96d |
|
| sa-east-1 | HVM (amd64) | ami-04879f2240402da1b |
|
| us-east-1 | HVM (amd64) | ami-0af56e57b9765d6b0 |
|
| us-east-2 | HVM (amd64) | ami-09207b4b2c351fadc |
|
| us-west-1 | HVM (amd64) | ami-082b6b073b0d596b9 |
|
| us-west-2 | HVM (amd64) | ami-02b46c73fed689d1c |
|
AWS China AMIs maintained by Giant Swarm
The following AMIs are not part of the official Flatcar Container Linux release process and may lag behind (query version).
View as json feed: amd64| EC2 Region | AMI Type | AMI ID | CloudFormation |
|---|---|---|---|
| cn-north-1 | HVM (amd64) | ami-0362ea42049a5e40d |
|
| cn-northwest-1 | HVM (amd64) | ami-0947dd3d77312ab18 |
|
CloudFormation will launch a cluster of Flatcar Container Linux machines with a security and autoscaling group.
Container Linux Configs
Flatcar Container Linux allows you to configure machine parameters, configure networking, launch systemd units on startup, and more via Container Linux Configs. These configs are then transpiled into Ignition configs and given to booting machines. Head over to the docs to learn about the supported features .
You can provide a raw Ignition config to Flatcar Container Linux via the Amazon web console or via the EC2 API .
As an example, this Container Linux Config will configure and start etcd:
etcd:
# All options get passed as command line flags to etcd.
# Any information inside curly braces comes from the machine at boot time.
# multi_region and multi_cloud deployments need to use {PUBLIC_IPV4}
advertise_client_urls: "http://{PRIVATE_IPV4}:2379"
initial_advertise_peer_urls: "http://{PRIVATE_IPV4}:2380"
# listen on both the official ports and the legacy ports
# legacy ports can be omitted if your application doesn't depend on them
listen_client_urls: "http://0.0.0.0:2379"
listen_peer_urls: "http://{PRIVATE_IPV4}:2380"
# generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3
# specify the initial size of your cluster with ?size=X
discovery: "https://discovery.etcd.io/<token>"
Instance storage
Ephemeral disks and additional EBS volumes attached to instances can be mounted with a .mount unit. Amazon’s block storage devices are attached differently
depending on the instance type
. Here’s the Container Linux Config to format and mount the first ephemeral disk, xvdb, on most instance types:
storage:
filesystems:
- mount:
device: /dev/xvdb
format: ext4
wipe_filesystem: true
systemd:
units:
- name: media-ephemeral.mount
enable: true
contents: |
[Mount]
What=/dev/xvdb
Where=/media/ephemeral
Type=ext4
[Install]
RequiredBy=local-fs.target
For more information about mounting storage, Amazon’s own documentation is the best source. You can also read about mounting storage on Flatcar Container Linux .
Adding more machines
To add more instances to the cluster, just launch more with the same Container Linux Config, the appropriate security group and the AMI for that region. New instances will join the cluster regardless of region if the security groups are configured correctly.
SSH to your instances
Flatcar Container Linux is set up to be a little more secure than other cloud images. By default, it uses the core user instead of root and doesn’t use a password for authentication. You’ll need to add an SSH key(s) via the AWS console or add keys/passwords via your Container Linux Config in order to log in.
To connect to an instance after it’s created, run:
ssh [email protected]<ip address>
Multiple clusters
If you would like to create multiple clusters you will need to change the “Stack Name”. You can find the direct template file on S3 .
Manual setup
TL;DR: launch three instances of
ami-09a1d378125110db3
(amd64) in us-east-1 with a security group that has open port 22, 2379, 2380, 4001, and 7001 and the same “User Data” of each host. SSH uses the core user and you have
etcd
and
Docker
to play with.
Creating the security group
You need open port 2379, 2380, 7001 and 4001 between servers in the etcd cluster. Step by step instructions below.
Note: This step is only needed once
First we need to create a security group to allow Flatcar Container Linux instances to communicate with one another.
- Go to the security group page in the EC2 console.
- Click “Create Security Group”
- Name: flatcar-testing
- Description: Flatcar Container Linux instances
- VPC: No VPC
- Click: “Yes, Create”
- In the details of the security group, click the
Inboundtab - First, create a security group rule for SSH
- Create a new rule:
SSH - Source: 0.0.0.0/0
- Click: “Add Rule”
- Create a new rule:
- Add two security group rules for etcd communication
- Create a new rule:
Custom TCP rule - Port range: 2379
- Source: type “flatcar-testing” until your security group auto-completes. Should be something like “sg-8d4feabc”
- Click: “Add Rule”
- Repeat this process for port range 2380, 4001 and 7001 as well
- Create a new rule:
- Click “Apply Rule Changes”
Launching a test cluster
We will be launching three instances, with a few parameters in the User Data, and selecting our security group.
- {% for region in site.data.alpha_channel.amis %} {% if region.name == 'us-east-1' %} Open the quick launch wizard to boot {{region.hvm}} (amd64). {% endif %} {% endfor %}
-
On the second page of the wizard, launch 3 servers to test our clustering
- Number of instances: 3
- Click "Continue"
- Next, we need to specify a discovery URL, which contains a unique token that allows us to find other hosts in our cluster. If you're launching your first machine, generate one at https://discovery.etcd.io/new?size=3, configure the `?size=` to your initial cluster size and add it to the metadata. You should re-use this key for each machine in the cluster.
-
Use ct to convert the following configuration into an Ignition config, and back in the EC2 dashboard, paste it into the "User Data" field.
```yaml
etcd:
# All options get passed as command line flags to etcd.
# Any information inside curly braces comes from the machine at boot time.
# multi_region and multi_cloud deployments need to use {PUBLIC_IPV4} advertise_client_urls: "http://{PRIVATE_IPV4}:2379" initial_advertise_peer_urls: "http://{PRIVATE_IPV4}:2380" # listen on both the official ports and the legacy ports # legacy ports can be omitted if your application doesn't depend on them listen_client_urls: "http://0.0.0.0:2379" listen_peer_urls: "http://{PRIVATE_IPV4}:2380" # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3 # specify the initial size of your cluster with ?size=X discovery: "https://discovery.etcd.io/<token>" ``` <ul> <li>Paste configuration into "User Data"</li> <li>"Continue"</li> </ul> </li> <li> Storage Configuration <ul> <li>"Continue"</li> </ul> </li> <li> Tags <ul> <li>"Continue"</li> </ul> </li> <li> Create Key Pair <ul> <li>Choose a key of your choice, it will be added in addition to the one in the gist.</li> <li>"Continue"</li> </ul> </li> <li> Choose one or more of your existing Security Groups <ul> <li>"flatcar-testing" as above.</li> <li>"Continue"</li> </ul> </li> <li> Launch! </li> </ol> </div> <div class="tab-pane" id="beta-manual"> <p>We will be launching three instances, with a few parameters in the User Data, and selecting our security group.</p> <ol> <li> {% for region in site.data.beta_channel.amis %} {% if region.name == 'us-east-1' %} Open the <a href="https://console.aws.amazon.com/ec2/home?region={{region.name}}#launchAmi={{region.hvm}}" target="_blank">quick launch wizard</a> to boot {{region.hvm}} (amd64). {% endif %} {% endfor %} </li> <li> On the second page of the wizard, launch 3 servers to test our clustering <ul> <li>Number of instances: 3</li> <li>Click "Continue"</li> </ul> </li> <li> Next, we need to specify a discovery URL, which contains a unique token that allows us to find other hosts in our cluster. If you're launching your first machine, generate one at <a href="https://discovery.etcd.io/new?size=3">https://discovery.etcd.io/new?size=3</a>, configure the `?size=` to your initial cluster size and add it to the metadata. You should re-use this key for each machine in the cluster. </li> <li> Use <a href="provisioning">ct</a> to convert the following configuration into an Ignition config, and back in the EC2 dashboard, paste it into the "User Data" field. ```yaml etcd: # All options get passed as command line flags to etcd. # Any information inside curly braces comes from the machine at boot time. # multi_region and multi_cloud deployments need to use {PUBLIC_IPV4} advertise_client_urls: "http://{PRIVATE_IPV4}:2379" initial_advertise_peer_urls: "http://{PRIVATE_IPV4}:2380" # listen on both the official ports and the legacy ports # legacy ports can be omitted if your application doesn't depend on them listen_client_urls: "http://0.0.0.0:2379" listen_peer_urls: "http://{PRIVATE_IPV4}:2380" # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3 # specify the initial size of your cluster with ?size=X discovery: "https://discovery.etcd.io/<token>" ``` <ul> <li>Paste configuration into "User Data"</li> <li>"Continue"</li> </ul> </li> <li> Storage Configuration <ul> <li>"Continue"</li> </ul> </li> <li> Tags <ul> <li>"Continue"</li> </ul> </li> <li> Create Key Pair <ul> <li>Choose a key of your choice, it will be added in addition to the one in the gist.</li> <li>"Continue"</li> </ul> </li> <li> Choose one or more of your existing Security Groups <ul> <li>"flatcar-testing" as above.</li> <li>"Continue"</li> </ul> </li> <li> Launch! </li> </ol> </div> <div class="tab-pane active" id="stable-manual"> <p>We will be launching three instances, with a few parameters in the User Data, and selecting our security group.</p> <ol> <li> {% for region in site.data.stable_channel.amis %} {% if region.name == 'us-east-1' %} Open the <a href="https://console.aws.amazon.com/ec2/home?region={{region.name}}#launchAmi={{region.hvm}}" target="_blank">quick launch wizard</a> to boot {{region.hvm}} (amd64). {% endif %} {% endfor %} </li> <li> On the second page of the wizard, launch 3 servers to test our clustering <ul> <li>Number of instances: 3</li> <li>Click "Continue"</li> </ul> </li> <li> Next, we need to specify a discovery URL, which contains a unique token that allows us to find other hosts in our cluster. If you're launching your first machine, generate one at <a href="https://discovery.etcd.io/new?size=3">https://discovery.etcd.io/new?size=3</a>, configure the `?size=` to your initial cluster size and add it to the metadata. You should re-use this key for each machine in the cluster. </li> <li> Use <a href="https://docs.flatcar-linux.org/os/provisioning/#config-transpiler">ct</a> to convert the following configuration into an Ignition config, and back in the EC2 dashboard, paste it into the "User Data" field. ```yaml etcd: # All options get passed as command line flags to etcd. # Any information inside curly braces comes from the machine at boot time. # multi_region and multi_cloud deployments need to use {PUBLIC_IPV4} advertise_client_urls: "http://{PRIVATE_IPV4}:2379" initial_advertise_peer_urls: "http://{PRIVATE_IPV4}:2380" # listen on both the official ports and the legacy ports # legacy ports can be omitted if your application doesn't depend on them listen_client_urls: "http://0.0.0.0:2379" listen_peer_urls: "http://{PRIVATE_IPV4}:2380" # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3 # specify the initial size of your cluster with ?size=X discovery: "https://discovery.etcd.io/<token>" ``` <ul> <li>Paste configuration into "User Data"</li> <li>"Continue"</li> </ul> </li> <li> Storage Configuration <ul> <li>"Continue"</li> </ul> </li> <li> Tags <ul> <li>"Continue"</li> </ul> </li> <li> Create Key Pair <ul> <li>Choose a key of your choice, it will be added in addition to the one in the gist.</li> <li>"Continue"</li> </ul> </li> <li> Choose one or more of your existing Security Groups <ul> <li>"flatcar-testing" as above.</li> <li>"Continue"</li> </ul> </li> <li> Launch! </li> </ol> </div>
Installation from a VMDK image
One of the possible ways of installation is to import the generated VMDK Flatcar image as a snapshot. The image file will be in https://${CHANNEL}.release.flatcar-linux.net/${ARCH}-usr/${VERSION}/flatcar_production_ami_vmdk_image.vmdk.bz2.
Make sure you download the signature (it’s available in https://${CHANNEL}.release.flatcar-linux.net/${ARCH}-usr/${VERSION}/flatcar_production_ami_vmdk_image.vmdk.bz2.sig) and check it before proceeding.
$ wget https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_production_ami_vmdk_image.vmdk.bz2
$ wget https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_production_ami_vmdk_image.vmdk.bz2.sig
$ gpg --verify flatcar_production_ami_vmdk_image.vmdk.bz2.sig
gpg: assuming signed data in 'flatcar_production_ami_vmdk_image.vmdk.bz2'
gpg: Signature made Thu 15 Mar 2018 10:27:57 AM CET
gpg: using RSA key A621F1DA96C93C639506832D603443A1D0FC498C
gpg: Good signature from "Flatcar Buildbot (Official Builds) <[email protected]>" [ultimate]
Then, follow the instructions in Importing a Disk as a Snapshot Using VM Import/Export . You’ll need to upload the uncompressed vmdk file to S3.
After the snapshot is imported, you can go to “Snapshots” in the EC2 dashboard, and generate an AMI image from it.
To make it work, use /dev/sda2 as the “Root device name” and you probably want to select “Hardware-assisted virtualization” as “Virtualization type”.
Using Flatcar Container Linux
Now that you have a machine booted it is time to play around. Check out the Flatcar Container Linux Quickstart guide or dig into more specific topics .
Edit this page