Introducing Azure Container Linux (ACL)

Today at Microsoft Build 2026, we’re announcing the general availability of Azure Container Linux (ACL): a secure, immutable container host designed to help platform teams run Kubernetes workloads at scale on Azure Kubernetes Service (AKS) with greater consistency, reduced operational overhead, and a stronger default security posture.

This release builds on Microsoft’s long-standing commitment to the Flatcar Container Linux ecosystem as a foundation for secure, minimal, and container-optimized operating systems. This commitment includes the acquisition of Kinvolk in 2021, bringing deep expertise in Flatcar development and cloud-native systems into Azure, and the subsequent donation of Flatcar to the Cloud Native Computing Foundation (CNCF), ensuring its continued growth as a community-driven project.

Flatcar has played a critical role in helping customers run cloud-native infrastructure at scale, introducing an immutable, minimal OS model that reduces configuration drift, minimizes attack surface, and simplifies lifecycle management. As customer needs continue to grow, there is an increasing demand for deeper integration with cloud platforms, stronger default security enforcement, and a more tightly managed supply chain experience in managed environments like AKS.

Building on this foundation, Azure Container Linux (ACL) represents the next evolution of this approach. ACL is intentionally built downstream of Flatcar to preserve compatibility with its ecosystem and leverage its mature, battle-tested design. ACL integrates Azure Linux binaries as the core foundation, providing consistency and compatibility with other Azure Linux use cases (including Azure Linux VMs), while bringing enterprise-hardened security and supportability into the platform. Looking ahead, ACL will further incorporate optional advanced code integrity capabilities from Azure Linux with OS Guard.

We remain committed to the Flatcar community and will continue contributing innovations upstream while bringing a fully managed, enterprise-ready product to customers through ACL.

Why a Trusted, Immutable Host Model Matters for AKS

As Kubernetes adoption scales, platform teams face increasing complexity in managing node-level consistency, security, and lifecycle operations across large fleets. Traditional OS models introduce challenges such as:

• Configuration drift across nodes, leading to inconsistent behavior and harder-to-debug issues
• Fragmented update mechanisms that increase operational overhead and risk during upgrades
• Expanding attack surface due to unnecessary packages and mutable system state
• Limited visibility and guarantees around the provenance and integrity of OS components

In managed environments like AKS, these challenges are amplified as teams look to operate clusters reliably at scale while meeting stricter security and compliance requirements.

Azure Container Linux: Built for Consistency and Trust

ACL addresses these challenges with a fully image-based operating system model that eliminates configuration drift, ensuring consistent behavior across nodes.

Updates are delivered through AKS node image upgrades, providing a consistent and repeatable way to roll out OS changes across clusters without relying on in-place modifications. By standardizing how nodes are built, updated, and operated, ACL helps ensure clusters remain in a known-good, reproducible state over time, even as they scale.

Over time, this model will continue to evolve to support A/B update mechanisms to further improve reliability, speed, and operational efficiency.

Secure from the Start, and Designed for the Future

ACL is engineered with a hardened security posture from the moment it boots. Its immutable design protects the integrity of the operating system, prevents unauthorized changes, and ensures consistent, reproducible behavior across your Kubernetes fleet. By removing unnecessary components and tightly constraining how the system can be modified, ACL reduces the attack surface and provides a strong foundation for running production workloads with confidence.

Under the hood, ACL incorporates several safeguards that reinforce its secure-by-default model:

• Read-only /usr filesystem to prevent tampering with core system components.
• A minimal package set purpose-built for container workloads, reducing CVE exposure.
• Mandatory access control with SELinux, enforcing strict least-privilege policies.
• Trusted Launch using a Unified Kernel Image (UKI) to bundle the kernel, initramfs, and kernel command line into a single signed artifact, ensuring integrity from the earliest stage.
• Signed Azure Linux RPMs delivered through a trusted, end-to-end Microsoft supply chain.

Going forward, we will continue to evolve ACL’s security posture as we bring over additional innovations from Azure Linux with OS Guard. This includes integrating code integrity into the ACL image, using the Integrity Policy Enforcement (IPE) Linux security module, to ensure that only binaries from trusted, signed volumes are allowed to execute. IPE will also extend to container images, ensuring that only binaries matching a trusted signature can be executed from verified dm-verity backed layers.

Where applicable, we are committed to contributing these advancements upstream to the Flatcar project, helping strengthen the ecosystem and ensuring that improvements benefit the broader cloud-native community.

Differentiating between Azure Container Linux and Existing Container Hosts on AKS

AKS now provides multiple generally available Linux OS options, including general-purpose container hosts (Azure Linux and Ubuntu) and an immutable container host (Azure Container Linux).

While all options are fully supported by Microsoft, they are designed to address distinct operational and security use cases. The sections below highlight the key differences to help you choose and position the right OS for your scenario.

*SELinux policies are subject to change over time based on customer feedback.

Day‑1 Ecosystem Partner Support 

Azure Container Linux is launching with support from a broad ecosystem of security, monitoring, networking, and data partners. The following partners are expected to offer support or validated integrations at Day‑1 availability: 

• Dynatrace – application performance monitoring and observability.
• Aquasec – database platform support on ACL.
• Qualys - vulnerability, compliance, and container security.
• Upwind - runtime cloud security and risk prioritization.
• Elastic - logs, metrics, and observability for Kubernetes.
• Isovalent – Kubernetes networking, observability, and security powered by eBPF (Cilium).

If you’re interested in becoming a supported Azure Container Linux partner, please reach out to: AzureLinuxPartners@microsoft.com

What Customers Are Saying

Early customer feedback highlights the real‑world impact of Azure Container Linux on improving security posture and operational consistency at scale.

“We’ve found working closely with the Microsoft product team throughout the Azure Container Linux preview to be invaluable. The product's immutability, minimal footprint, and built‑in security controls (such as SELinux and Trusted Launch) will strengthen our AKS security posture across every deployment instance in Nationwide. Furthermore, its focus on secure‑by‑design foundations is especially timely as we face advanced threat detection capabilities within the industry.” - Enterprise Container Platform, Cloud - Nationwide

Engineered for AKS from Day One

Azure Container Linux is deeply integrated with AKS to ensure a seamless operational experience. It is compatible with many critical AKS extensions and add‑ons, and works smoothly with existing application containers and deployment workflows. ACL is available across AMD64 and Arm64 architectures, ensuring consistent behavior across environments, and includes support for GPU-enabled workloads.

Enabling ACL is as simple as specifying the following in your node pool configuration:

--os-sku AzureContainerLinux

Command to provision an Azure Container Linux cluster on AKS using Azure CLI

Whether you're onboarding new clusters or migrating existing ones, ACL is designed to integrate into your environment with minimal friction.

A Clear Path Forward for AKS Preview Users

With the release of Azure Container Linux, AKS will transition to offer one unified immutable host offering. This work started with our use of Flatcar Container Linux in Preview and now continues with the GA release of ACL. As part of this release, Flatcar will no longer be available via --os-sku on AKS. Please note, this change applies specifically to the AKS preview experience; Flatcar is not being retired.

Later this year we will complete the convergence of our immutable OS offerings by incorporating remaining kernel and runtime features of the current OS Guard preview into ACL.  At that time, existing users of OS Guard will receive a guided transition to ACL, ensuring operational continuity while consolidating to a single container host.

Get Started with Azure Container Linux

ACL is GA and available today for all AKS customers. To begin using ACL in your clusters and explore documentation, best practices, and deployment guidance, visit: aka.ms/azurecontainerlinux

ACL represents the future of secure, cloud-optimized Linux on AKS—building on the proven foundation of Flatcar, advancing it with Azure Linux innovations, and contributing back to the open-source ecosystem that customers depend on.

We’re thrilled to bring this new foundation to our customers and can’t wait to see what you build with it.

Learn More

• //Build Session: Build, deploy, and run Linux workloads on Azure
• Azure Container Linux documentation: https://aka.ms/azurecontainerlinux
• Azure Container Linux on GitHub: https://github.com/microsoft/azure-container-linux
• Azure Linux product page: https://aka.ms/AzureLinuxProduct
• Azure Linux documentation: https://aka.ms/azurelinux
• Joining the ISV partner program: AzureLinuxPartners@microsoft.com