Merge pull request #249669 from schaffererin/azlinuxbenefits

Enhancements to key Azure Linux benefits section

Author: JamesJBarnett

articles/azure-linux/intro-azure-linux.md

@@ -5,12 +5,12 @@ author: htaubenfeld
 ms.author: htaubenfeld
 ms.service: microsoft-linux
 ms.topic: overview
-ms.date: 06/01/2023
+ms.date: 09/05/2023
 ---
 
 # What is the Azure Linux Container Host for AKS?
 
-The Azure Linux Container Host is an operating system image that's optimized for running container workloads on [Azure Kubernetes Service (AKS)](../../articles/aks/intro-kubernetes.md). It's maintained by Microsoft and based on Microsoft Azure Linux, an open-source Linux distribution created by Microsoft.
+The Azure Linux Container Host is an operating system image that's optimized for running container workloads on [Azure Kubernetes Service (AKS)](../../articles/aks/intro-kubernetes.md). Microsoft maintains the Azure Linux Container Host and based it on [CBL-Mariner][cbl-mariner], an open-source Linux distribution created by Microsoft.
 
 The Azure Linux Container Host is lightweight, containing only the packages needed to run container workloads. It's hardened based on significant validation tests and internal usage and is compatible with Azure agents. It provides reliability and consistency from cloud to edge across AKS, AKS for Azure Stack HCI, and Azure Arc. You can deploy Azure Linux node pools in a new cluster, add Azure Linux node pools to your existing clusters, or migrate your existing nodes to Azure Linux nodes.
 
@@ -20,10 +20,20 @@ To learn more about Azure Linux, see the [Azure Linux GitHub repository](https:/
 
 The Azure Linux Container Host offers the following key benefits:
 
-- **Secure supply chain**: Microsoft builds, signs, and validates the Azure Linux Container Host packages from source, and hosts its packages and sources in Microsoft-owned and secured platforms.
-- **Small and lightweight**: The Azure Linux Container Host only includes the necessary set of packages needed to run container workloads. As a result, it consumes limited disk and memory resources.
-- **Secure by default**: The Azure Linux Container Host has an emphasis on security and follows the secure-by-default principles, including using a hardened Linux kernel with Azure cloud optimizations and flags tuned for Azure. It also provides a reduced attack surface and eliminates patching and maintenance of unnecessary packages. For more information on Azure Linux Container Host security principles, see the [AKS security concepts](../../articles/aks/concepts-security.md).
-- **Extensively validated**: The AKS and Azure Linux teams run a suite of functional and performance regression tests with the Azure Linux Container Host before releasing to customers, which enables earlier issue detection and mitigation.​
+- **Small and lightweight**
+  - The Azure Linux Container Host only includes the necessary set of packages needed to run container workloads. As a result, it consumes limited disk and memory resources.
+  - Azure Linux has only 500 packages, and as a result takes up the least disk space by up to *5 GB* on AKS.
+- **Secure supply chain**
+  - The Linux and AKS teams at Microsoft build, sign, and validate the [Azure Linux Container Host packages][azure-linux-packages] from source, and host packages and sources in Microsoft-owned and secured platforms.
+  - Each package update runs through a full set of unit tests and end-to-end testing on the existing image to prevent regressions. The extensive testing, in combination with the smaller package count, reduces the chances of disruptive updates to applications.
+- **Secure by default**
+  - The Azure Linux Container Host has an emphasis on security. It follows the secure-by-default principles, including using a hardened Linux kernel with Azure cloud optimizations and flags tuned for Azure. It also provides a reduced attack surface and eliminates patching and maintenance of unnecessary packages.
+  - Microsoft monitors the CVE database and releases security patches monthly and critical updates within days if necessary.
+  - Azure Linux passes all the [CIS Level 1 benchmarks][cis-benchmarks], making it the only Linux distribution on AKS that does so.
+  - For more information on Azure Linux Container Host security principles, see the [AKS security concepts](../../articles/aks/concepts-security.md).
+- **Maintains compatibility with existing workloads**
+  - All existing and future AKS extensions, add-ons, and open-source projects on AKS support both Ubuntu and Azure Linux. This includes support for runtime components like Dapr, IaC tools like Terraform, and monitoring solutions like Dynatrace.
+  - Azure Linux ships with containerd as its container runtime and the upstream Linux kernel, which enables existing containers based on Linux images (like Alpine) to work seamlessly on Azure Linux.
 
 > [!NOTE]
 >
@@ -36,3 +46,10 @@ The Azure Linux Container Host offers the following key benefits:
 - Learn more about [Azure Linux Container Host core concepts](./concepts-core.md).
 - Follow our tutorial to [Deploy, manage, and update applications](./tutorial-azure-linux-create-cluster.md).
 - Get started by [Creating an Azure Linux Container Host for AKS cluster using Azure CLI](./quickstart-azure-cli.md).
+
+<!-- LINKS - external -->
+[cbl-mariner]: https://github.com/microsoft/CBL-Mariner
+[azure-linux-packages]: https://packages.microsoft.com/cbl-mariner/2.0/prod/
+
+<!-- LINKS - internal -->
+[cis-benchmarks]: ../aks/cis-azure-linux.md