Deterministic upgrades through versioned repositories on AL2027
AL2027 Preview
AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.
Note
By default, your AL2027 instance doesn't automatically receive additional security updates at launch. Your instance initially contains the updates that were available in the AL2027 release of the chosen AMI.
AL2027 uses deterministic upgrades through versioned repositories, the same update
model as AL2023. The feature is turned on by default. To unlock a system so that every
dnf operation uses the newest release, see Using persistent override with deterministic upgrade. Each AL2027 release is a version of
the package repositories. Each AMI and container image locks to the release version
it was built from. Whenever we release new package updates, there is a new version to lock
to. New AMIs and container images lock to that new version.
With this model, you control consistency of package versions and updates across your environment:
Multiple instances launched from the same AMI install identical package versions, even when you provision them at different times. Additional packages installed during provisioning come from the repository version of that AMI.
AL2027 does not apply updates automatically. You apply updates on a schedule that meets your needs, to a release version you have tested.
After we publish a release, it is immutable. Newer releases do not affect in-progress deployments.
Topics
Differences between minor and major version upgrades
Major version releases of Amazon Linux (such as AL2023 to AL2027) include large-scale updates and might add, remove, or change packages. Upgrade to a new major version only after you test your application on that version.
Minor version releases of AL2027 include feature and security updates while keeping Linux features and the system library API stable. Testing your application before a minor update is not required, but staged rollouts remain best practice. For more information, see Best practices for safely deploying updates.
Knowing when updates are available
To apply an update, you need to know that one is available. The changes in each release
are documented in the AL2027 Release Notes, and security
issues addressed in package updates are covered by Amazon Linux Security advisories for AL2027. On a running system, dnf check-release-update reports
newer releases. You can also Receive notifications on new updates.
For building derived AMIs when new AL2027 AMIs are released, EC2 Image Builder can automatically build, patch, and test AMIs. For patching in-place across a fleet, you can use tools such as Amazon Systems Manager Patch Manager.
Other AMIs and container images based on AL2027 might have their own release schedule and notification methods. When you use derived images, check the publisher's documentation for when updates are released.
Control the package updates available from the AL2027 repositories
When we publish a new version of the AL2027 repositories, all previous versions remain available. By default, the system locks to the release version that was used to build the AMI or container image. To move to a newer version:
-
Discover available repository versions.
sudo dnf check-release-update -
Upgrade to the version you selected.
sudo dnf upgrade --releasever=<version>
The command lists the package updates and asks for confirmation before applying them.
After the upgrade completes, the new release version becomes the default release version for
all future dnf operations. For more information, see
Manage package and operating system updates in AL2027.