Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Image Confidential Space adalah OS minimal bertujuan tunggal yang dijalankan di instance Confidential VM. Dirancang untuk menjalankan satu
workload hanya sekali, tanpa
penyimpanan persisten. Workload tersebut disusun di atas image Confidential Space
menggunakan Docker.
Image Confidential Space di-build berdasarkan peningkatan kualitas keamanan yang ada di
Container-Optimized OS
dan menambahkan manfaat berikut:
Partisi disk terenkripsi dengan perlindungan integritas
Koneksi jaringan terenkripsi yang diautentikasi
Berbagai pengukuran booting
Akses jarak jauh dan alat khusus cloud dinonaktifkan
Jenis gambar
Image Confidential Space tersedia dalam dua varian:
Produksi: Image produksi digunakan untuk menjalankan beban kerja produksi sebenarnya dengan data produksi sebenarnya. Data tersebut dikunci untuk mencegah operator workload
mengakses data yang diproses. Untuk mengetahui informasi selengkapnya, lihat
Ringkasan keamanan Confidential Space.
Debug: Image debug digunakan untuk
menguji beban kerja Anda pada data
non-produksi. SSH diaktifkan pada image debug, dan operator memiliki akses root ke VM yang menjalankan workload. VM yang menjalankan image debug tidak berhenti
setelah beban kerja selesai.
Anda dapat menetapkan jenis image yang akan digunakan saat Anda
men-deploy workload.
Siklus proses gambar Confidential Space
Saat Anda membuat Confidential VM menggunakan image Confidential Space, versi terbaru
image akan digunakan. Jika Anda selalu menghapus Confidential VM saat workload Anda selesai dan membuat VM baru setiap kali Anda menjalankan workload, maka Anda dapat memastikan image sudah yang terbaru.
Namun, workload yang berjalan lama atau menjalankan workload di VM yang dibuat pada
masa lalu membuat Anda berisiko menggunakan image Confidential Space yang sudah tidak berlaku, yang
dapat menimbulkan kerentanan keamanan.
Untuk memitigasi hal ini, kolaborator data dapat
menggunakan atribut dukungan
untuk memeriksa apakah versi image Confidential Space produksi yang berjalan di VM sudah
baru, dan menolak aksesnya ke data mereka jika tidak lulus.
Ada tiga atribut dukungan:
LATEST: Ini adalah versi terbaru image, dan didukung serta
dipantau kerentanannya. Gambar LATEST juga STABLE dan
USABLE.
STABLE: Versi gambar ini didukung dan dipantau untuk mendeteksi kerentanan. Gambar STABLE juga USABLE.
USABLE: Gambar yang hanya memiliki atribut ini tidak didukung. Gunakan dengan menanggung sendiri risikonya.
Versi gambar
Anda dapat melihat image Confidential Space terbaru dengan perintah gcloud
berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eConfidential Space images are minimal, single-purpose operating systems designed to run a single workload on a Confidential VM without persistent storage, layered with Docker.\u003c/p\u003e\n"],["\u003cp\u003eThese images enhance security through encrypted disk partitions, authenticated and encrypted network connections, boot measurements, and disabled remote access, building on Container-Optimized OS.\u003c/p\u003e\n"],["\u003cp\u003eTwo types of Confidential Space images are available: Production images, used for secure data processing, and Debug images, used for testing with root access and enabled SSH.\u003c/p\u003e\n"],["\u003cp\u003eProduction images have support attributes like \u003ccode\u003eLATEST\u003c/code\u003e, \u003ccode\u003eSTABLE\u003c/code\u003e, and \u003ccode\u003eUSABLE\u003c/code\u003e to indicate their status and vulnerability monitoring, while Debug images do not have these attributes.\u003c/p\u003e\n"],["\u003cp\u003eYou can use \u003ccode\u003egcloud compute images list\u003c/code\u003e commands with specific flags to view and filter available Confidential Space images, including production, debug, and deprecated versions.\u003c/p\u003e\n"]]],[],null,["# Confidential Space images\n\n*** ** * ** ***\n\nA Confidential Space image is a minimal, single-purpose OS that's run on a\n[Confidential VM](/confidential-computing/confidential-vm/docs/confidential-vm-overview) instance. It's\ndesigned to run a single\n[workload](/confidential-computing/confidential-space/docs/create-customize-workloads) only once, without\npersistent storage. That workload is layered on top of the Confidential Space image\nusing [Docker](https://www.docker.com/).\n\nConfidential Space images are built on the existing security enhancements of\n[Container-Optimized OS](/container-optimized-os/docs)\nand add the following benefits:\n\n- Encrypted disk partitions with integrity protection\n\n- Authenticated, encrypted network connections\n\n- Various boot measurements\n\n- Disabled remote access and cloud-specific tooling\n\nTypes of images\n---------------\n\nConfidential Space images are available in two variants:\n\n- Production: The production image is used for running real production workloads\n with real production data. It is locked down to prevent the workload operator\n from accessing the processed data. For more information, see\n [Confidential Space security overview](/docs/security/confidential-space).\n\n- Debug: The debug image is used for\n [testing your workload](/confidential-computing/confidential-space/docs/monitor-debug) on non-production\n data. SSH is enabled on the debug image, and the operator has root access to\n the VM that runs the workload. The VM running the debug image doesn't stop\n after the workload is complete.\n\nYou can set which image type to use when you\n[deploy the workload](/confidential-computing/confidential-space/docs/deploy-workloads).\n\nConfidential Space image lifecycle\n----------------------------------\n\nWhen you create a Confidential VM using a Confidential Space image, the latest version\nof the image is used. If you always delete your Confidential VM when your workload\nis done and create a new one each time you run the workload, then you can be\nsure the image is up to date.\n\nHowever, long-running workloads or running a workload on a VM created in the\npast opens you up to the risk of using an outdated Confidential Space image, which\nmight introduce security vulnerabilities.\n\nTo mitigate this, a data collaborator can\n[use support attributes](/confidential-computing/confidential-space/docs/create-grant-access-confidential-resources?tab=image-assertions#support_attributes)\nto check if a production Confidential Space image version running on a VM is\nrecent, and deny it access to their data if it doesn't pass.\n\nThere are three support attributes:\n\n- `LATEST`: This is the latest version of the image, and is supported and\n monitored for vulnerabilities. The `LATEST` image is also `STABLE` and\n `USABLE`.\n\n- `STABLE`: This version of the image is supported and monitored for\n vulnerabilities. A `STABLE` image is also `USABLE`.\n\n- `USABLE`: An image with only this attribute is out of support. Use it at your\n own risk.\n\n| **Note:** Debug images don't have support attributes. When testing workloads, data collaborators need to remove checks for support attributes from their workload identity pools.\n\nImage versions\n--------------\n\nYou can view the latest Confidential Space images with the following `gcloud`\ncommand: \n\n gcloud compute images list \\\n --project=confidential-space-images \\\n --no-standard-images\n\nThe following flags can change the returned images in the results:\n\n- Add the `--show-deprecated` flag to show older images.\n\n- Add `--filter=\"family~'confidential-space$'\"` flag to show production images.\n\n- Add `--filter=\"family~'confidential-space-debug$'\"` flag to show debug images.\n\nThe following tables detail the available Confidential Space image versions and\ntheir support attributes.\n\n### Production images\n\nThe following table contains Confidential Space image production versions.\n\n### Debug images\n\nThe following table contains Confidential Space image debug versions."]]
