Amazon Linux 2027 public preview enforces SELinux by default breaking permissive-mode applications

Amazon Linux 2027 enters public preview with SELinux enforcing mode enabled by default, a change from AL2023’s permissive mode. This shift means applications that previously ran without policy violations being enforced will now fail if their access patterns, file contexts, or ports conflict with SELinux rules. The preview’s primary value is allowing teams to test and adjust policies before general availability, as AWS has not provided a timeline for AL2023’s end-of-support or AL2027’s GA date.

The lack of an in-place upgrade path from AL2023 to AL2027 complicates migration. While cloud-native practices often treat instances as disposable, teams with stateful or long-lived instances, referred to as 'pets' in the community, face manual rebuilds or root volume replacements. AWS has not addressed this gap in the announcement, leaving teams to plan for instance replacement rather than seamless upgrades. The preview’s availability in all commercial regions mitigates some deployment friction, but the delay in on-premises images limits testing for hybrid environments.

SELinux enforcing mode is the most disruptive operational change, but the kernel version remains fluid. AL2027 starts with kernel 7.1, but AWS intends to update it until it reaches an LTS version, meaning the final GA kernel may differ. This uncertainty affects teams relying on specific kernel features or drivers, though the inclusion of AWS-LC for cryptographic operations and Neuron support for ML workloads suggests cloud-optimized performance remains a priority. Testing should focus on SELinux policy compliance first, as kernel changes are less likely to break applications outright.

Community feedback highlights skepticism about Amazon Linux’s long-term value compared to alternatives like Rocky or Alma. Some users view it as a no-strings-attached RHEL derivative, while others question its necessity given the availability of upstream sources. AWS’s cloud-optimization claims may not outweigh the perceived redundancy for teams already using other distributions. The preview’s documentation and GitHub repository provide a feedback channel, but adoption will depend on how well AWS addresses migration pain points and clarifies support timelines.