Kebijakan peluncuran menggantikan variabel metadata VM yang ditetapkan oleh operator workload untuk membatasi tindakan berbahaya. Penulis workload dapat
menetapkan kebijakan dengan label
sebagai bagian dari pembuatan image container mereka.
String nama variabel lingkungan yang diizinkan dan dipisahkan koma yang
diizinkan untuk ditetapkan oleh operator workload dengan
nilai metadata
tee-env-ENVIRONMENT_VARIABLE_NAME.
tee.launch_policy.allow_mount_destinations
Berinteraksi dengan:
Operator beban kerja: Variabel
tee-mount
metadata.
String yang dipisahkan dengan titik dua
String direktori pemasangan yang diizinkan dan dipisahkan dengan titik dua yang dapat dipasang oleh operator
beban kerja menggunakan tee-mount.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[[["\u003cp\u003eLaunch policies, set by workload authors, override VM metadata variables to prevent malicious actions, using labels in \u003ccode\u003eDockerfile\u003c/code\u003e or Bazel BUILD files.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003etee.launch_policy.allow_cmd_override\u003c/code\u003e policy determines if the \u003ccode\u003eCMD\u003c/code\u003e in a container's \u003ccode\u003eDockerfile\u003c/code\u003e can be overridden by a workload operator via the \u003ccode\u003etee-cmd\u003c/code\u003e metadata variable.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003etee.launch_policy.allow_env_override\u003c/code\u003e policy allows workload operators to set specific environment variables using \u003ccode\u003etee-env-\u003c/code\u003e metadata variables, with a comma-separated list of permitted names.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003etee.launch_policy.allow_mount_destinations\u003c/code\u003e policy defines a colon-separated string of allowed mount directories for workload operators using the \u003ccode\u003etee-mount\u003c/code\u003e variable.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003etee.launch_policy.monitoring_memory_allow\u003c/code\u003e policy controls workload memory usage monitoring when the \u003ccode\u003etee-memory-monitoring-enable\u003c/code\u003e variable is true, offering options like \u003ccode\u003edebugonly\u003c/code\u003e, \u003ccode\u003ealways\u003c/code\u003e, or \u003ccode\u003enever\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Launch policies\n\n[Workload author](/confidential-computing/confidential-space/docs/confidential-space-overview#roles)\n\n*** ** * ** ***\n\nLaunch policies override the [VM metadata variables](/confidential-computing/confidential-space/docs/reference/metadata-variables#metadata-variables)\nset by workload operators to restrict malicious actions. A workload author can\nset policies with a [label](https://docs.docker.com/engine/reference/builder/#label)\nas part of building their container image.\n\nFor example, in a `Dockerfile`: \n\n LABEL \"tee.launch_policy.allow_cmd_override\"=\"true\"\n\nIn a Bazel BUILD file: \n\n container_image(\n ...\n labels={\"tee.launch_policy.allow_cmd_override\":\"true\"}\n ...\n )\n\nThe available launch policies are in the following table:"]]
