Bottlerocket: Enterprise Linux Ledger 2026 Scorecard

Part of the Enterprise Linux Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (open source, AWS led, supported on AWS through AWS Support plans)
Owner: Amazon Web Services leads development on GitHub; no foundation
Licence: Apache 2.0 or MIT at the user's option; free; AWS Support plans cover it on EKS and ECS
Latest release: 1.66.0 (2026-09-22); 1.67.0 published 2026-10-13 with a pre-release flag
Support lifecycle: Per variant: aws-k8s and vmware-k8s 1.31 to 1.37, aws-ecs-2 and aws-ecs-3 with FIPS and NVIDIA builds; a variant retires when its Kubernetes or ECS version does; bare metal and ECS-1 variants are no longer supported
Next milestone: ecs-4 variants out of preview (no date)
Support window: No calendar window; each Kubernetes variant lives as long as that Kubernetes version on EKS (source: project README)
Tier: Container host
Archetype: Kubernetes-paced upstream rider
Evidence grade: B. The changelog, README, security features document and GitHub release feed were read from the project repository, and the 2020 GA post from the AWS open source blog; every dated trigger comes from a changelog header. Fleet, integration, partner and skills scores are inferred from AWS service behaviour, and the date on which bare metal variants were dropped was not found.

Scope of the scores: Bottlerocket's lifecycle runs per variant and per Kubernetes version, so the lifecycle score measures the update mechanism and the published variant list rather than a multi-year window. It was admitted under the container-host provision.

Scorecard

Dimension	Score	Direction
Capability today	62.5 / 100	higher is better
Momentum since end of 2022	+6.0 points (2020 to 2022: +6.0)	higher is better
Credibility	17.5 / 25	higher is better
Commercial risk	5.0 / 25	lower is better
Technical lock-in	11.0 / 25	lower is better
Integrator fit	8.0 / 20	higher is better
AI leverage	4.5 / 20	higher is better
Ledger Index	57.2 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Lifecycle and upgrades (15)	n/a	n/a	3	3
Security and compliance (15)	n/a	n/a	3	4
Hardware and architectures (10)	n/a	n/a	2	2.5
Virtualization and cloud images (10)	n/a	n/a	3	2.5
Containers and Kubernetes host (10)	n/a	n/a	4	4.5
Software currency and packaging (10)	n/a	n/a	2.5	2.5
Fleet management and automation (10)	n/a	n/a	3.5	3.5
Storage and filesystems (5)	n/a	n/a	2	2
Enterprise integration and certifications (5)	n/a	n/a	1.5	1.5
AI and GPU readiness (10)	n/a	n/a	2.5	3.5
Total / 100	n/a	n/a	56.5	62.5

Year by year: 2020: 50.5 · 2021: 50.5 · 2022: 56.5 · 2023: 60.0 · 2024: 62.5 · 2025: 62.5 · 2026: 62.5

What moved the score

Year	Domain	Change	Points	Trigger
2022	AI and GPU readiness	1 → 2.5	+3.0	1.6.0 (2022-02-07): aws-k8s-1.21-nvidia variant with NVIDIA drivers
2022	Software currency and packaging	2 → 2.5	+1.0	1.9.0 (2022-07-28): bootstrap containers for host customisation
2022	Virtualization and cloud images	2 → 3	+2.0	1.6.0 and 1.6.2 (2022-02 and 2022-03): metal-k8s variant added, VMware variants out of preview
2023	Containers and Kubernetes host	4 → 4.5	+1.0	1.15.0: aws-ecs-2 variants; one variant per Kubernetes minor with a published supported list
2023	Hardware and architectures	2 → 2.5	+1.0	1.15.0: kernel 6.1 line; x86_64 and aarch64 since 1.0
2023	Security and compliance	3 → 3.5	+1.5	1.15.0 (2023-09-18): Secure Boot for new variants on UEFI platforms
2024	AI and GPU readiness	2.5 → 3	+1.0	1.21.0 (2024-08-06): Neuron kernel module on the 6.1 kernel; NVIDIA variants per Kubernetes minor
2024	Security and compliance	3.5 → 4	+1.5	1.27.0 (2024-11-12): FIPS variants
2026	AI and GPU readiness	3 → 3.5	+1.0	1.66.0 (2026-09-22): opt-in NVIDIA GPU DRA for Kubernetes 1.34 to 1.37; driver branch selection at boot
2026	Virtualization and cloud images	3 → 2.5	-1.0	Bare metal Kubernetes variants no longer supported (README; removal date unverified)

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-09	1.15.0: Secure Boot, kernel 6.1, aws-ecs-2 variants	Security	V
2024-05	1.20.0: Kubernetes 1.30 variants	Containers	U
2024-08	1.21.0: Kubernetes 1.27 metal and VMware variants dropped; Neuron module for the 6.1 kernel	Lifecycle	U
2024-11	1.27.0: FIPS variants	Security	C
2025-05	1.39.0: kernel 6.12 for all variants except FIPS	Hardware	U
2025-11	EKS stops AL2 AMIs; Bottlerocket named with AL2023 as the supported node images	Containers	P
2026-01	1.53.0: SBOM in SPDX 2.3 and CycloneDX 1.6 written into every image	Security	C
2026-05	1.61.0: Kubernetes 1.36 variants; ecs-4 variants in preview	Containers	V
2026-06	1.62.0: squashfs for kernel 6.12 and 6.18	Hardware	U
2026-07	1.64.0: static and transparent hugepages; aws-k8s-1.30 variants removed	Lifecycle	U
2026-09	1.66.0: opt-in NVIDIA GPU DRA; NVIDIA driver branch selection at boot	AI	U

Centre of gravity: Security (3), Containers (3), Lifecycle (2)
Blind spots (no items): Virtualization and cloud, Packaging, Fleet management, Storage, Enterprise integration, Licensing, Governance
Driver mix: Vision 18%, Customer need 18%, Market window 0%, Upstream 55%, Portfolio 9%
Idea-to-need index: 0.50 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 17.5 / 25

Criterion	Score	Basis
Cadence	4.5	A release every two to four weeks through 2026, each dated in the changelog
Roadmap transparency	3.5	Public GitHub issues and changelog; previews are labelled; no dated roadmap
Say-do	3.5	Secure Boot, FIPS, SBOM and GPU DRA all shipped; the ecs-4 preview has been open since 2026-05
Velocity	3.5	Most releases carry a kernel, variant or security feature beyond rebases
Lifecycle stability	2.5	Variants retire with Kubernetes versions; bare metal and ECS-1 variants were dropped

Commercial risk: 5.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	0	Free; nothing to raise
Purchase constraints	0.5	Open source; AWS Support plans apply only on EKS and ECS
Channel and access	0.5	Open download and public AMIs; VMware images published by the project
Owner stability	1.5	AWS employees lead; no foundation and no stated governance beyond GitHub
Cost of staying supported	2.5	Nodes must move to a newer variant whenever a Kubernetes version retires

Technical lock-in: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Own image layout, TOML settings and API; no package manager
Export path	2	Workloads are containers and move; host configuration does not transfer
Stack coupling	2	Update operator, control container and SSM are AWS paths; VMware variants exist
Hardware / cloud coupling	3	AWS first; VMware variants remain; bare metal variants are gone
Skills and tooling coupling	2	API-driven administration without a shell is unfamiliar to most Linux teams

Integrator fit: 8.0 / 20

Criterion	Score	Basis
Partner programme openness	1	No programme; AWS Partner Network in general
Multi-tenancy and self-service	1	Nothing in the OS
API and infrastructure-as-code	4	Settings API, TOML user data, CloudFormation, Terraform and Karpenter
Skills and certification	2	AWS training only

AI leverage: 4.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	n/a	2.5	3	2026: Opt-in GPU DRA for Kubernetes 1.34 to 1.37 and driver branch selection at boot; sharing is scheduled by Kubernetes
AI platform stack	n/a	0	0	2020: None
AI-assisted operations	n/a	0	0	2020: None
Agent openness	n/a	1.5	1.5	2020: Settings API through apiclient and the control container; no agent interface

Year by year: 2020: 2.5 · 2021: 2.5 · 2022: 4 · 2023: 4 · 2024: 4 · 2025: 4 · 2026: 4.5

AI say-do, 2023 to 2026: 3 AI items announced; 3 GA, 0 still preview, 0 pending, 0 dropped. Neuron kernel module (2024-08), NVIDIA driver branch selection and opt-in GPU DRA (2026-09) all shipped as GA in the release that announced them.

Bottlerocket ships NVIDIA and Neuron driver variants for each Kubernetes minor and added opt-in GPU dynamic resource allocation in 2026, so GPU nodes are a first-class case. It has no AI stack, no assistant and no agent interface; those are AWS service concerns.

Reading

Bottlerocket does one job well: it is an image-based, read-only, SELinux-enforcing host that updates atomically and rolls back on a failed boot, and it has added Secure Boot, FIPS variants, an SBOM in every image and GPU resource allocation since 2023. Its weakness as an enterprise Linux is structural: there is no calendar lifecycle, variants retire with Kubernetes versions, bare metal variants are gone, and nobody supports it outside AWS. A buyer should check that the Kubernetes minor they run has a variant with the FIPS or NVIDIA build they need, because those exist for some combinations only. For EKS and ECS nodes it is the lowest-maintenance choice in this group.

Open questions and items to re-score

Date on which bare metal Kubernetes variants stopped being supported: the README lists them as unsupported but the removal release was not found (grade C); the 2026 fall in the virtualization score is placed on the read date.
Whether AWS publishes a support period for a variant beyond its Kubernetes or ECS version; a third-party page claims three years, which is not on an AWS page.
FIPS scope: only aws-ecs-3-fips is named on the README; whether aws-k8s FIPS variants exist for every supported minor was not checked.
ecs-4 variants have been in preview since 1.61.0 (2026-05-18) with no GA date.
Meaning of the pre-release flag on 1.67.0 (2026-10-13) and whether it is a normal release.
The Bottlerocket update operator and bare metal first release dates were not read; the fleet score is held flat since 2020.