Daemonic Dispatches

FreeBSD/EC2: Community vs. Marketplace AMIs

FreeBSD has been available in Amazon EC2 since FreeBSD 9.0 (January 2012), and from FreeBSD 10.2 (August 2015) AMIs have been built by the FreeBSD release enginering team as part of the regular release process. Release announcements go out with a block of text about where to find FreeBSD in EC2, for example (taken from the FreeBSD 11.1 release announcement):

   FreeBSD 11.1-RELEASE amd64 is also available on these cloud hosting
   platforms:

     * Amazon(R) EC2(TM):
       AMIs are available in the following regions:

         ap-south-1 region: ami-8a760ee5
         eu-west-2 region: ami-f2425396
         eu-west-1 region: ami-5302ec2a
         ap-northeast-2 region: ami-f575ab9b
         ap-northeast-1 region: ami-0a50b66c
         sa-east-1 region: ami-9ad8acf6
         ca-central-1 region: ami-622e9106
         ap-southeast-1 region: ami-6d75e50e
         ap-southeast-2 region: ami-bda2bede
         eu-central-1 region: ami-7588251a
         us-east-1 region: ami-70504266
         us-east-2 region: ami-0d725268
         us-west-1 region: ami-8b0128eb
         us-west-2 region: ami-dda7bea4

       AMIs will also available in the Amazon(R) Marketplace once they have
       completed third-party specific validation at:
       https://aws.amazon.com/marketplace/pp/B01LWSWRED/

This leads to a question I am frequently asked: Which way should FreeBSD users launch their instances? The answer, as usual, is "it depends". Here are some of the advantages of each option, to help you decide which to use.

"Community" AMIs

These are the AMIs with numbers listed in the release announcement. If you want to launch FreeBSD 11.1-RELEASE in us-west-2, find the line which says 'us-west-2' in the FreeBSD 11.1-RELEASE announcement, and there's the number of the AMI you want to launch. (In this case, ami-dda7bea4.) You can then put that into your aws ec2 run-instances command line; or if you're using the EC2 Management Console you can click on 'Launch Instance', 'Community AMIs', then enter the AMI number into the box labelled 'Search Community AMIs'.

Benfits of using the Community AMIs:

• You get the AMI number from the signed release announcement; there's no risk of clicking on "FreeBSD" and getting someone else's "customized" image.
• The release announcement tells you the AMI number for the region you want to use. You can copy and paste this into your scripts.
• This mechanism has been around for over a decade and everything "just works".

Disadvantages of using the Community AMIs:

• FreeBSD only publishes AMIs in the regions which exist when the FreeBSD release goes out. If you want to launch FreeBSD 11.1 into the upcoming EC2 region in France, you're out of luck. (I occasionally copy AMIs after the fact, especially if someone asks for them; but since the new AMIs can't be retroactively added to the release announcement, there's no way for you to know if a community AMI which claims to be FreeBSD 11.1-RELEASE really is. Don't just assume — there are people publishing AMIs containing malware!)
• Copying AMI numbers around works great for scripts, but can be annoying when it comes to interactive launching of instances.

"Marketplace" AMIs

The AWS Marketplace is designed as a sales channel for products based on AWS, replacing a previous mechanism called "paid AMIs". This aspect of it is entirely irrelevant to FreeBSD — FreeBSD, as the name suggests, is free — but its design as a sales channel gives it some other advantages:

• Rather than needing to look up individual AMI numbers, you can simply point your web browser at the "product" page for FreeBSD 10 or FreeBSD 11. (In each case, you'll get the latest release from the stable branch by default; but you can select older releases if you want.) From there it takes just a few clicks to launch FreeBSD.
• When AWS launches in a new region, the AWS Marketplace will make images available there; you'll be able to launch FreeBSD instances without worrying about whether the AMI you found is the "real" FreeBSD.
• Amazon provides me with statistics about the "sales" of FreeBSD AMIs. I suppose that for some users this type of tracking could count as a disadvantage — but I find it useful to know that yesterday there were 1000 AWS accounts which collectively had a total of over 10,000 FreeBSD instances running.

Using the Marketplace images has some disadvantages, however — again arising out of its nature as a product catalogue built on top of the lower level AWS infrastructure:

• The AWS Marketplace often lags behind EC2 in adding support for new regions and instance types.
• Because adding images to the AWS Marketplace is a manual process, we only do this for FreeBSD releases — not for the weekly snapshots or the beta and release candidate images in the months leading up to the release.
• Due to issues relating to how EC2 tracks "product codes", if you detach the root disk of an instance launched from the AWS Marketplace, you won't be able to attach it to a running EC2 instance — instead, you have to stop the target instance first. This is admittedly a somewhat unusual use case; but it's an essential one for me: During FreeBSD development, I often end up with unbootable instances (usually by installing a broken kernel), and being able to move the disk into a working instance and fix things makes my life much easier.

In general, I'd say that for "regular users" the AWS Marketplace is probably the better option, while for developers the "Community" images — with all the snapshots and pre-release images, and the ability to swap disks around more easily — is likely to be more convenient. Of course, there's no need to lock yourself into just one or the other; be aware of both and use whichever suits your needs the most at any particular time.