Cloud-native workloads face increasingly sophisticated
threats—from rootkits and container escapes to unauthorized code execution—that
demand stronger security guarantees. To address these challenges, Microsoft has
introduced Azure Linux with OS Guard, now available in public preview.
Built on the FedRAMP-certified Azure Linux 3.0 base, OS
Guard is a next-generation immutable container host that enforces immutability,
code integrity, and mandatory access control. It leverages advanced
technologies like dm-verity, SELinux, and Integrity Policy Enforcement
(IPE)—recently upstreamed in Linux kernel 6.12—to ensure only trusted binaries
from signed sources can run, while locking down user space against tampering.
With Trusted Launch enabled by default, OS Guard also secures boot components
using measured integrity backed by vTPM keys.
Azure Linux is the trusted OS powering Microsoft’s own
fleet, and OS Guard builds on that foundation to deliver enhanced protection
for cloud-native environments.
Learn more.