Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Anda dapat membuat instance Confidential VM berdasarkan image Linux kustom Anda sendiri.
Proses ini sama dengan
membuat image Linux kustom untuk Compute Engine,
dengan persyaratan tambahan.
Persyaratan image kustom Confidential VM
Pastikan untuk mengikuti persyaratan berikut saat membuat image kustom untuk instance Confidential VM.
Detail kernel Linux
AMD SEV dan SEV-SNP
Versi kernel minimum yang diperlukan untuk Confidential VM berbeda-beda, bergantung pada teknologi yang Anda butuhkan.
Untuk SEV, gunakan kernel versi 5.11 atau yang lebih baru.
Untuk SEV dengan migrasi langsung, gunakan kernel versi 6.6 atau yang lebih baru. Untuk kernel dukungan jangka panjang (LTS), gunakan LTS versi 6.1 atau yang lebih baru.
Untuk SEV-SNP, gunakan 6.1LTS atau yang lebih baru.
Selain itu, pastikan opsi kernel berikut diaktifkan:
CONFIG_AMD_MEM_ENCRYPT
CONFIG_GVE
CONFIG_NET_VENDOR_GOOGLE
CONFIG_PCI_MSI
CONFIG_SWIOTLB
Jika Anda perlu menggunakan versi kernel yang lebih lama, Anda mungkin perlu melakukan pekerjaan tambahan untuk menginstal driver perangkat.
Intel TDX
Untuk dukungan Intel TDX, gunakan kernel versi 6.6 atau yang lebih baru.
Selain itu, pastikan opsi kernel berikut diaktifkan:
CONFIG_GVE
CONFIG_NET_VENDOR_GOOGLE
CONFIG_PCI_MSI
CONFIG_SWIOTLB
Driver perangkat Pengontrol Antarmuka Jaringan Virtual Google (gVNIC)
Gunakan driver gVNIC versi 1.01 atau yang lebih baru. Untuk mengetahui petunjuk tambahan, lihat
Menggunakan NIC Virtual Google.
Antarmuka NVMe
Antarmuka NVMe harus tersedia selama booting di sistem operasi tamu untuk persistent disk dan SSD yang terpasang.
Kernel dan image initramfs (jika digunakan) harus menyertakan modul driver NVMe untuk memasang direktori root.
Tag fitur sistem operasi
Pembuatan instance Confidential VM mengharuskan image memiliki salah satu tag fitur OS tamu berikut, bergantung pada teknologi Confidential Computing yang digunakan:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eConfidential VM instances can be created using custom Linux images, following a similar process as standard Compute Engine custom image creation but with specific additional requirements.\u003c/p\u003e\n"],["\u003cp\u003eThe minimum kernel version for Confidential VM varies depending on the required technology: SEV needs 5.11 or later, SEV with live migration requires 6.6 or 6.1 LTS or later, and SEV-SNP or Intel TDX require 6.1LTS or later or 6.6 or later respectively.\u003c/p\u003e\n"],["\u003cp\u003eSpecific kernel options such as \u003ccode\u003eCONFIG_AMD_MEM_ENCRYPT\u003c/code\u003e, \u003ccode\u003eCONFIG_GVE\u003c/code\u003e, \u003ccode\u003eCONFIG_NET_VENDOR_GOOGLE\u003c/code\u003e, \u003ccode\u003eCONFIG_PCI_MSI\u003c/code\u003e, and \u003ccode\u003eCONFIG_SWIOTLB\u003c/code\u003e must be enabled in the kernel configuration for both AMD SEV/SEV-SNP and Intel TDX.\u003c/p\u003e\n"],["\u003cp\u003eThe gVNIC driver must be version 1.01 or later, and the NVMe interface must be available at boot with the appropriate driver included in the kernel and initramfs.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a Confidential VM instance, the image must include specific guest OS feature tags such as \u003ccode\u003eSEV_CAPABLE\u003c/code\u003e, \u003ccode\u003eSEV_LIVE_MIGRATABLE_V2\u003c/code\u003e, \u003ccode\u003eSEV_SNP_CAPABLE\u003c/code\u003e, or \u003ccode\u003eTDX_CAPABLE\u003c/code\u003e, as well as \u003ccode\u003eGVNIC\u003c/code\u003e, \u003ccode\u003eUEFI_COMPATIBLE\u003c/code\u003e, and \u003ccode\u003eVIRTIO_SCSI_MULTIQUEUE\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create custom Confidential VM images\n\nYou can create a Confidential VM instance based on your own custom Linux image.\nThis is the same process as\n[creating a custom Linux image for Compute Engine](/compute/docs/images/create-custom),\nwith additional requirements.\n\nConfidential VM custom image requirements\n-----------------------------------------\n\nMake sure to follow these requirements when building a custom image for a\nConfidential VM instance.\n\n### Linux kernel details\n\n### AMD SEV and SEV-SNP\n\nThe minimum kernel version required for Confidential VM differs depending on the\ntechnology you need.\n\n- For SEV, use kernel version 5.11 or later.\n\n- For SEV with live migration, use kernel version 6.6 or later. For long-term\n support (LTS) kernels, use version 6.1 LTS or later.\n\n- For SEV-SNP, use 6.1LTS or later.\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_AMD_MEM_ENCRYPT`\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\nIf you need to use earlier kernel versions, you might need to do additional\nwork to install device drivers.\n\n### Intel TDX\n\nFor Intel TDX support, use kernel version 6.6 or later.\n\nFor instructions on adding TDX support to a kernel, see\n[Instruction to set up TDX host and guest](https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#kernel-configuration-for-tdx-support).\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\n### Google Virtual Network Interface Controller (gVNIC) device driver\n\nUse version 1.01 or later of the gVNIC driver. For additional instructions, see\n[Using Google Virtual NIC](/compute/docs/networking/using-gvnic).\n| **Note:** Some operating systems misreport the default gVNIC driver as version 1.0, even if it's newer and works with Confidential VM. If you find the gVNIC device isn't working, upgrade the driver.\n\n### NVMe interface\n\nThe NVMe interface must be available during boot on the guest operating system\nfor persistent disks and attached SSDs.\n\nThe kernel and initramfs image (if used) must include the NVMe driver module to\nmount the root directory.\n\n### Operating system feature tags\n\nConfidential VM instance creation requires that the image has one of the\nfollowing guest OS feature tags, depending on the Confidential Computing\ntechnology in use:\n\n- `SEV_CAPABLE`\n\n- `SEV_LIVE_MIGRATABLE_V2`\n\n- `SEV_SNP_CAPABLE`\n\n- `TDX_CAPABALE`\n\nThe following OS feature tags should also be added:\n\n- `GVNIC`\n\n- `UEFI_COMPATIBLE`\n\n- `VIRTIO_SCSI_MULTIQUEUE`\n\nSee\n[Enable guest operating system features on custom images](/compute/docs/images/create-custom#guest-os-features)\nto learn how to add a tag with the `--guest-os-features` flag.\n\nWhat's next\n-----------\n\nLearn more about using [operating system images](/compute/docs/images) to create\nboot disks for Compute Engine instances."]]
