Requisitos de imagem personalizada da VM confidencial
Siga estes requisitos ao criar uma imagem personalizada para uma
instância de VM confidencial.
Detalhes do kernel do Linux
AMD SEV e SEV-SNP
A versão mínima do kernel necessária para a VM confidencial varia de acordo com a
tecnologia que você precisa.
Para SEV, use a versão 5.11 ou mais recente do kernel.
Para SEV com migração em tempo real, use a versão 6.6 ou mais recente do kernel. Para kernels de suporte de longo prazo (LTS), use a versão 6.1 LTS ou mais recente.
Para SEV-SNP, use 6.1LTS ou uma versão mais recente.
Além disso, verifique se as seguintes opções de kernel estão ativadas:
CONFIG_AMD_MEM_ENCRYPT
CONFIG_GVE
CONFIG_NET_VENDOR_GOOGLE
CONFIG_PCI_MSI
CONFIG_SWIOTLB
Se você precisar usar versões mais antigas do kernel, será necessário realizar tarefas adicionais
para instalar os drivers do dispositivo.
Intel TDX
Para suporte ao Intel TDX, use a versão 6.6 ou mais recente do kernel.
A interface NVMe precisa estar disponível durante a inicialização no sistema operacional convidado
para discos permanentes e SSDs conectados.
O kernel e a imagem initramfs (se usados) precisam incluir o módulo do driver NVMe para
ativar o diretório raiz.
Tags de recursos do sistema operacional
A criação de instâncias de VM confidencial exige que a imagem tenha uma das
seguintes tags de recurso do SO convidado, dependendo da tecnologia de
computação confidencial em uso:
SEV_CAPABLE
SEV_LIVE_MIGRATABLE_V2
SEV_SNP_CAPABLE
TDX_CAPABALE
As seguintes tags de recursos do SO também precisam ser adicionadas:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-18 UTC."],[[["\u003cp\u003eConfidential VM instances can be created using custom Linux images, following a similar process as standard Compute Engine custom image creation but with specific additional requirements.\u003c/p\u003e\n"],["\u003cp\u003eThe minimum kernel version for Confidential VM varies depending on the required technology: SEV needs 5.11 or later, SEV with live migration requires 6.6 or 6.1 LTS or later, and SEV-SNP or Intel TDX require 6.1LTS or later or 6.6 or later respectively.\u003c/p\u003e\n"],["\u003cp\u003eSpecific kernel options such as \u003ccode\u003eCONFIG_AMD_MEM_ENCRYPT\u003c/code\u003e, \u003ccode\u003eCONFIG_GVE\u003c/code\u003e, \u003ccode\u003eCONFIG_NET_VENDOR_GOOGLE\u003c/code\u003e, \u003ccode\u003eCONFIG_PCI_MSI\u003c/code\u003e, and \u003ccode\u003eCONFIG_SWIOTLB\u003c/code\u003e must be enabled in the kernel configuration for both AMD SEV/SEV-SNP and Intel TDX.\u003c/p\u003e\n"],["\u003cp\u003eThe gVNIC driver must be version 1.01 or later, and the NVMe interface must be available at boot with the appropriate driver included in the kernel and initramfs.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a Confidential VM instance, the image must include specific guest OS feature tags such as \u003ccode\u003eSEV_CAPABLE\u003c/code\u003e, \u003ccode\u003eSEV_LIVE_MIGRATABLE_V2\u003c/code\u003e, \u003ccode\u003eSEV_SNP_CAPABLE\u003c/code\u003e, or \u003ccode\u003eTDX_CAPABLE\u003c/code\u003e, as well as \u003ccode\u003eGVNIC\u003c/code\u003e, \u003ccode\u003eUEFI_COMPATIBLE\u003c/code\u003e, and \u003ccode\u003eVIRTIO_SCSI_MULTIQUEUE\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create custom Confidential VM images\n\nYou can create a Confidential VM instance based on your own custom Linux image.\nThis is the same process as\n[creating a custom Linux image for Compute Engine](/compute/docs/images/create-custom),\nwith additional requirements.\n\nConfidential VM custom image requirements\n-----------------------------------------\n\nMake sure to follow these requirements when building a custom image for a\nConfidential VM instance.\n\n### Linux kernel details\n\n### AMD SEV and SEV-SNP\n\nThe minimum kernel version required for Confidential VM differs depending on the\ntechnology you need.\n\n- For SEV, use kernel version 5.11 or later.\n\n- For SEV with live migration, use kernel version 6.6 or later. For long-term\n support (LTS) kernels, use version 6.1 LTS or later.\n\n- For SEV-SNP, use 6.1LTS or later.\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_AMD_MEM_ENCRYPT`\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\nIf you need to use earlier kernel versions, you might need to do additional\nwork to install device drivers.\n\n### Intel TDX\n\nFor Intel TDX support, use kernel version 6.6 or later.\n\nFor instructions on adding TDX support to a kernel, see\n[Instruction to set up TDX host and guest](https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#kernel-configuration-for-tdx-support).\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\n### Google Virtual Network Interface Controller (gVNIC) device driver\n\nUse version 1.01 or later of the gVNIC driver. For additional instructions, see\n[Using Google Virtual NIC](/compute/docs/networking/using-gvnic).\n| **Note:** Some operating systems misreport the default gVNIC driver as version 1.0, even if it's newer and works with Confidential VM. If you find the gVNIC device isn't working, upgrade the driver.\n\n### NVMe interface\n\nThe NVMe interface must be available during boot on the guest operating system\nfor persistent disks and attached SSDs.\n\nThe kernel and initramfs image (if used) must include the NVMe driver module to\nmount the root directory.\n\n### Operating system feature tags\n\nConfidential VM instance creation requires that the image has one of the\nfollowing guest OS feature tags, depending on the Confidential Computing\ntechnology in use:\n\n- `SEV_CAPABLE`\n\n- `SEV_LIVE_MIGRATABLE_V2`\n\n- `SEV_SNP_CAPABLE`\n\n- `TDX_CAPABALE`\n\nThe following OS feature tags should also be added:\n\n- `GVNIC`\n\n- `UEFI_COMPATIBLE`\n\n- `VIRTIO_SCSI_MULTIQUEUE`\n\nSee\n[Enable guest operating system features on custom images](/compute/docs/images/create-custom#guest-os-features)\nto learn how to add a tag with the `--guest-os-features` flag.\n\nWhat's next\n-----------\n\nLearn more about using [operating system images](/compute/docs/images) to create\nboot disks for Compute Engine instances."]]
