Flatcar Container Linux
by cloudimg
Immutable, self-updating container host Linux with Docker built in, secure by default.
Flatcar Container Linux is a minimal, immutable Linux distribution built for one job: running containers reliably at scale. It is an open, actively maintained continuation of the CoreOS Container Linux lineage, developed under the Cloud Native Computing Foundation (CNCF). This cloudimg image ships the stable channel, imported unmodified from the Flatcar project's own official Azure image, with its SHA-512 verified before publishing.
The operating system is immutable: /usr is mounted read-only and delivered as a single verified unit, and there is no package manager at all. Rather than patching package by package, Flatcar updates itself atomically — update_engine downloads each new stable release to an inactive A/B partition and switches to it on reboot. This image leaves that native auto-update on and pinned to the stable channel, so the machine stays current without ever changing channels. You extend the system with containers and with configuration under the writable /etc, /opt and /var — Docker and containerd are already installed and ready to run workloads.
It is secure by default. SSH is key-only with password authentication off, the root account password is locked, and only port 22 is reachable on the network; SELinux is enabled. Every virtual machine generates its own unique machine ID and SSH host keys on first boot, so nothing is shared between customers, and no password, bundled key or swap ships in the image. Azure provisions the machine through the Azure Linux Agent, which installs the SSH key you supply for the core user — no Ignition or custom data is required for a normal SSH deployment, and Azure VM extensions are available.
Flatcar Container Linux is open-source software; the Flatcar project is licensed under Apache-2.0, free and open source with no per-CPU or per-deployment fee. cloudimg is not affiliated with or endorsed by the Flatcar project, the CNCF or Microsoft. cloudimg provides packaging, verification, and 24/7 support with a guaranteed 24 hour response SLA.