Achten Sie außerdem darauf, dass die folgenden Kernel-Optionen aktiviert sind:
CONFIG_GVE
CONFIG_NET_VENDOR_GOOGLE
CONFIG_PCI_MSI
CONFIG_SWIOTLB
Gerätetreiber für Google Virtual Network Interface Controller (gVNIC)
Verwenden Sie Version 1.01 oder höher des gVNIC-Treibers. Weitere Anleitungen finden Sie unter Google Virtual NIC verwenden.
NVMe-Schnittstelle
Die NVMe-Schnittstelle muss während des Startvorgangs auf dem Gastbetriebssystem für nichtflüchtige Speicher und angehängte SSDs verfügbar sein.
Der Kernel und das initramfs-Image (falls verwendet) müssen zum Bereitstellen des Stammverzeichnisses das NVMe-Treibermodul enthalten.
Tags für Betriebssystemfunktionen
Für die Erstellung einer Confidential VM-Instanz muss das Image eines der folgenden Gastbetriebssystem-Feature-Tags haben, je nach verwendeter Confidential Computing-Technologie:
SEV_CAPABLE
SEV_LIVE_MIGRATABLE_V2
SEV_SNP_CAPABLE
TDX_CAPABALE
Außerdem sollten die folgenden OS-Feature-Tags hinzugefügt werden:
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-08-18 (UTC)."],[[["\u003cp\u003eConfidential VM instances can be created using custom Linux images, following a similar process as standard Compute Engine custom image creation but with specific additional requirements.\u003c/p\u003e\n"],["\u003cp\u003eThe minimum kernel version for Confidential VM varies depending on the required technology: SEV needs 5.11 or later, SEV with live migration requires 6.6 or 6.1 LTS or later, and SEV-SNP or Intel TDX require 6.1LTS or later or 6.6 or later respectively.\u003c/p\u003e\n"],["\u003cp\u003eSpecific kernel options such as \u003ccode\u003eCONFIG_AMD_MEM_ENCRYPT\u003c/code\u003e, \u003ccode\u003eCONFIG_GVE\u003c/code\u003e, \u003ccode\u003eCONFIG_NET_VENDOR_GOOGLE\u003c/code\u003e, \u003ccode\u003eCONFIG_PCI_MSI\u003c/code\u003e, and \u003ccode\u003eCONFIG_SWIOTLB\u003c/code\u003e must be enabled in the kernel configuration for both AMD SEV/SEV-SNP and Intel TDX.\u003c/p\u003e\n"],["\u003cp\u003eThe gVNIC driver must be version 1.01 or later, and the NVMe interface must be available at boot with the appropriate driver included in the kernel and initramfs.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a Confidential VM instance, the image must include specific guest OS feature tags such as \u003ccode\u003eSEV_CAPABLE\u003c/code\u003e, \u003ccode\u003eSEV_LIVE_MIGRATABLE_V2\u003c/code\u003e, \u003ccode\u003eSEV_SNP_CAPABLE\u003c/code\u003e, or \u003ccode\u003eTDX_CAPABLE\u003c/code\u003e, as well as \u003ccode\u003eGVNIC\u003c/code\u003e, \u003ccode\u003eUEFI_COMPATIBLE\u003c/code\u003e, and \u003ccode\u003eVIRTIO_SCSI_MULTIQUEUE\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create custom Confidential VM images\n\nYou can create a Confidential VM instance based on your own custom Linux image.\nThis is the same process as\n[creating a custom Linux image for Compute Engine](/compute/docs/images/create-custom),\nwith additional requirements.\n\nConfidential VM custom image requirements\n-----------------------------------------\n\nMake sure to follow these requirements when building a custom image for a\nConfidential VM instance.\n\n### Linux kernel details\n\n### AMD SEV and SEV-SNP\n\nThe minimum kernel version required for Confidential VM differs depending on the\ntechnology you need.\n\n- For SEV, use kernel version 5.11 or later.\n\n- For SEV with live migration, use kernel version 6.6 or later. For long-term\n support (LTS) kernels, use version 6.1 LTS or later.\n\n- For SEV-SNP, use 6.1LTS or later.\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_AMD_MEM_ENCRYPT`\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\nIf you need to use earlier kernel versions, you might need to do additional\nwork to install device drivers.\n\n### Intel TDX\n\nFor Intel TDX support, use kernel version 6.6 or later.\n\nFor instructions on adding TDX support to a kernel, see\n[Instruction to set up TDX host and guest](https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#kernel-configuration-for-tdx-support).\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\n### Google Virtual Network Interface Controller (gVNIC) device driver\n\nUse version 1.01 or later of the gVNIC driver. For additional instructions, see\n[Using Google Virtual NIC](/compute/docs/networking/using-gvnic).\n| **Note:** Some operating systems misreport the default gVNIC driver as version 1.0, even if it's newer and works with Confidential VM. If you find the gVNIC device isn't working, upgrade the driver.\n\n### NVMe interface\n\nThe NVMe interface must be available during boot on the guest operating system\nfor persistent disks and attached SSDs.\n\nThe kernel and initramfs image (if used) must include the NVMe driver module to\nmount the root directory.\n\n### Operating system feature tags\n\nConfidential VM instance creation requires that the image has one of the\nfollowing guest OS feature tags, depending on the Confidential Computing\ntechnology in use:\n\n- `SEV_CAPABLE`\n\n- `SEV_LIVE_MIGRATABLE_V2`\n\n- `SEV_SNP_CAPABLE`\n\n- `TDX_CAPABALE`\n\nThe following OS feature tags should also be added:\n\n- `GVNIC`\n\n- `UEFI_COMPATIBLE`\n\n- `VIRTIO_SCSI_MULTIQUEUE`\n\nSee\n[Enable guest operating system features on custom images](/compute/docs/images/create-custom#guest-os-features)\nto learn how to add a tag with the `--guest-os-features` flag.\n\nWhat's next\n-----------\n\nLearn more about using [operating system images](/compute/docs/images) to create\nboot disks for Compute Engine instances."]]
