AWS eks: Add CimFS snapshotter documentation for EKS Windows AMIs
Summary
Documents the opt-in CimFS containerd snapshotter for Amazon EKS-optimized Windows Server 2025 AMIs, including the -EnableCimFS bootstrap parameter, EKS_ENABLE_CIMFS environment variable, and launch template example.
Security assessment
The change documents a performance-oriented container image snapshotter feature and its configuration options. It does not address a vulnerability, credential handling, authorization, encryption, or other security control.
Evidence
+The Amazon EKS-optimized Windows Server 2025 AMIs include support for the [Composite Image File System (CimFS)](https://learn.microsoft.com/en-us/windows/win32/fileio/composite-image-file-system) `containerd` snapshotter, as described on the Microsoft Learn website. CimFS stores container image layers as `.cim` archives, which can reduce cold image pull times for large Windows container images.
Diff
diff --git a/eks/latest/userguide/eks-optimized-windows-ami.md b/eks/latest/userguide/eks-optimized-windows-ami.md index 1074ff7aa..58e38ef10 100644 --- a//eks/latest/userguide/eks-optimized-windows-ami.md +++ b//eks/latest/userguide/eks-optimized-windows-ami.md @@ -7 +7 @@ -Release calendarBootstrap script configuration parametersCached container imagesMore information +Release calendarBootstrap script configuration parametersCached container imagesCimFS snapshotterMore information @@ -97,0 +98,2 @@ The script includes the following command-line parameters: + * `-EnableCimFS` – (Optional) Turns on the Composite Image File System (CimFS) `containerd` snapshotter. This is an opt-in feature that is only available on Amazon EKS-optimized Windows Server 2025 AMIs for Kubernetes version `1.35` and later. For more information, see CimFS snapshotter. + @@ -108,0 +111,2 @@ The script takes into account the following environment variables: + * `EKS_ENABLE_CIMFS` – Set to `true` or `1` to turn on the CimFS `containerd` snapshotter. Refer to the `-EnableCimFS` command line parameter for the definition. + @@ -137,0 +142,31 @@ The following cached container images are for the `containerd` runtime: +## CimFS snapshotter + +The Amazon EKS-optimized Windows Server 2025 AMIs include support for the [Composite Image File System (CimFS)](https://learn.microsoft.com/en-us/windows/win32/fileio/composite-image-file-system) `containerd` snapshotter, as described on the Microsoft Learn website. CimFS stores container image layers as `.cim` archives, which can reduce cold image pull times for large Windows container images. + +CimFS is an opt-in feature. It is available only on Amazon EKS-optimized Windows Server 2025 AMIs (Core and Full) for Kubernetes version `1.35` and later. CimFS is turned off by default. + +###### Windows Server version requirement + +CimFS is supported only on Windows Server 2025 (build 26100) and later. Turning it on has no effect on earlier Windows Server versions because the CimFS `containerd` configuration is not present in those AMIs. + +The AMI ships a pre-built CimFS `containerd` configuration (`config-cimfs.toml`) alongside the default configuration. When you turn on CimFS, the bootstrap script swaps in the CimFS configuration, restarts `containerd`, and re-caches the pause and base container images with the CimFS snapshotter. + +To turn on CimFS for a node, use either of the following methods (see Bootstrap script configuration parameters): + + * Pass the `-EnableCimFS` switch to the `Start-EKSBootstrap.ps1` bootstrap script. + + * Set the `EKS_ENABLE_CIMFS` machine-scoped environment variable to `true` or `1` before the bootstrap script runs. + + + + +The following example shows how to turn on CimFS from the launch template user data: + + + <powershell> + [string]$EKSBootstrapScriptFile = "$env:ProgramFiles\Amazon\EKS\Start-EKSBootstrap.ps1" + & $EKSBootstrapScriptFile -EKSClusterName "my-cluster" -EnableCimFS 3>&1 4>&1 5>&1 6>&1 + </powershell> + +The stream redirection (`3>&1 4>&1 5>&1 6>&1`) lets you see the bootstrap script’s warning, verbose, debug, and information output in the instance’s user data log for troubleshooting. +