Notes from the workshop
Engineering decisions, catalog news and practical guides — written by the team that maintains the images.
ARM64 by default: why we build our AMIs on Graviton
When we designed our images we had to pick a default architecture. We thought it through, measured, and settled on ARM64. Here is why we believe it is the best option for most people, and why —if you need x86_64— all you have to do is ask.
Shrink the size and boot time of your AMIs
A bloated image boots slowly, costs more to store and widens your attack surface. Slimming your AMIs and speeding up their boot improves your autoscaling, your bill and your security in one move. Here is how.
Machine images for AI and GPUs in 2026: what changes when GPUs enter the picture
Assembling a GPU-based AI environment by hand is a festival of drivers, CUDA versions and frameworks that refuse to line up. A well-prepared GPU image saves you days of pain. Here is what an AI AMI should carry in 2026.
ARM and Graviton: migrate your images and cut your cloud bill
ARM stopped being a phone thing a long time ago: today it powers a huge share of the cloud and offers a price-performance ratio that is hard to ignore. Migrating your images to Graviton can trim your bill noticeably. Here is how, and with what care.
How to migrate to a new AMI without service interruptions
Updating the image that holds up your service does not have to mean a sleepless night or a maintenance page. With the right strategy you switch AMIs with zero downtime and a reverse gear always within reach.
BYOL vs hourly pricing: understand the licensing and cost of your AMIs
Do you bring your own licence or pay by the hour when you use an image? The answer changes your bill, your flexibility and your legal obligations. This guide helps you pick the model that actually suits you.
Secrets management: never bake credentials into an AMI
A password inside an image is a leak waiting to happen: it gets copied, shared and stays forever in a snapshot. The rule is simple and admits no exceptions: secrets never go in the image. Here is how to do it right.
SBOM for machine images: inventory and traceability for your software
When the next critical vulnerability lands, the question will be: "am I affected?". Without an SBOM the answer takes days of manual searching. With one, seconds. Here is what it is and how to generate it for your images.
cloud-init and user-data: configure your instances at boot like a pro
A golden AMI handles what is stable; cloud-init handles what changes. Mastering user-data and cloud-init is what lets you use one image in a thousand scenarios without rebaking it. Here is the practical guide.
Hardened AMIs for Kubernetes nodes: the secure foundation of your cluster
Kubernetes is only as secure as the nodes it runs on. A hardened, patched and tuned node AMI is the foundation many teams overlook. Here is how to build the ideal base image for EKS and self-managed clusters.
Rebuilding AMIs on a critical CVE: automate your vulnerability response
When the next Log4Shell lands, the clock is running. Organisations that rebuild and redistribute their image within hours sleep soundly; those that patch by hand do not. This is the architecture for responding to a critical CVE automatically.
AWS vs Azure vs GCP: comparing machine images across clouds
AMI, Managed Image, Custom Image: every cloud has its own name and its own rules for the same thing, a template to boot machines from. If you work across several clouds, understanding the differences saves you surprises.
Cloud trends 2026: immutable images, FinOps and AI set the pace
2026 arrives with a cloud that is pricier, more regulated and more intelligent. For those who build and deploy infrastructure, three currents —immutability, cost control and AI-driven automation— define where to put the focus this year.
AMIs vs containers: when each one fits (and when to combine them)
Machine image or container? The question is framed wrong: they do not compete, they complement each other. Understanding what each one solves saves you from over-engineering and helps you pick the right tool for every workload.
How to choose a trustworthy AMI before deploying to production
Not every public image is safe, and not every safe image fits your case. Before booting an instance on somebody else's AMI, it pays to look under the hood. This is the checklist that discerning teams use.
Encryption, patching and compliance: the security triad of your cloud images
Encrypting the data, keeping patches current and being able to prove it in an audit: three practices that, combined, turn your machine images into a trusted asset instead of a latent risk.
CIS hardening of AMIs: a practical guide to hardening your EC2 images
An unhardened image is an open door waiting for someone to walk through. Applying the CIS Benchmarks to your AMIs lifts your security posture in one move and brings you closer to compliance. Here is how to do it without slowing your team down.
AMI lifecycle: versioning, encryption and automated cleanup
Creating an AMI is easy; governing it over time is what separates a professional team from a graveyard of orphaned images and inflated bills. This is the complete guide to versioning, encrypting and cleaning up your images painlessly.
Golden AMI with Packer: how to build a reproducible pipeline step by step
A well-built golden AMI is the difference between deploying in seconds with confidence and fighting servers that are never quite the same. In this technical guide we assemble a reproducible Packer pipeline, ready for production.
Zabbix 7.0 LTS now available: what changes in our AMI
Refreshed frontend, SLA widgets and a rewritten SQS reader. We go over what's new in the LTS line and how to migrate from 6.0 without losing history.
Why we keep maintaining the Bitnami stacks
When Bitnami stopped publishing, thousands of teams were left without patches. This is what we did.