Public Preview: Azure Linux OS Guard for AKS

Cloud-native workloads face increasingly sophisticated threats—from rootkits and container escapes to unauthorized code execution—that demand stronger security guarantees. To address these challenges, Microsoft has introduced Azure Linux with OS Guard, now available in public preview. 

Built on the FedRAMP-certified Azure Linux 3.0 base, OS Guard is a next-generation immutable container host that enforces immutability, code integrity, and mandatory access control. It leverages advanced technologies like dm-verity, SELinux, and Integrity Policy Enforcement (IPE)—recently upstreamed in Linux kernel 6.12—to ensure only trusted binaries from signed sources can run, while locking down user space against tampering. With Trusted Launch enabled by default, OS Guard also secures boot components using measured integrity backed by vTPM keys. 

Azure Linux is the trusted OS powering Microsoft’s own fleet, and OS Guard builds on that foundation to deliver enhanced protection for cloud-native environments. 

Learn more.