• Decision: Support these Linux distributions as Kubernetes worker nodes (and for local Podman development), in this priority order: (1) Ubuntu 24.04 LTS — moving to 26.04 LTS when released, (2) Bottlerocket, (3) Flatcar Container Linux, (4) Talos Linux, (5) Fedora CoreOS, (6) Rocky Linux. Tier 1 is the reference platform: it gates release, and the deploy/podman harness plus the e2e suite must pass there before support for any other tier is claimed.
• Reason: These are the distributions actually used for Kubernetes worker nodes in the eBPF ecosystem — Cilium performs the same cgroup connect4/sockops attach this project relies on, so the model is proven at scale on them — and each ships a cgroup v2 unified hierarchy plus BTF, this project's hard kernel requirements (AD-007). Ubuntu leads because it is the most common worker-node OS across managed and self-managed Kubernetes and matches the AppArmor environment the harness already handles (AD-009). Bottlerocket and Flatcar follow as purpose-built container-node OSes; Talos and Fedora CoreOS cover the immutable/newest-kernel end; Rocky covers the enterprise EL9 case.
• Trade-off: The LSM story is not portable. AD-009's confinement workaround (--security-opt apparmor=unconfined) is AppArmor-specific and therefore Tier-1-specific; tiers 2, 3, 5 and 6 are SELinux distributions and will need a distinct policy approach rather than the same flag, and Talos (Tier 4) exposes no shell for interactive debugging (API-only), so the harness must be driven entirely through its API. Supporting six platforms also multiplies the verification matrix: each tier needs its own real e2e run, never a claim inherited from Tier 1.
• Scope: Whole project — deploy/ (harness portability), Feature 03's e2e suite, and a future 04-platform-support feature for per-distro verification.
• Date: 2026-09-19
• Status: active — no tier is verified yet. All six rows are Planned; Tier 1 becomes Verified only once the e2e suite passes on a clean Ubuntu 24.04 VM. All work to date ran on a single developer workstation (kernel 7.0.0-31-generic), which is explicitly not a supported-platform claim.