[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Preconfigured base images\n\nGoogle Cloud maintains the following base images designed for use with\nCloud Workstations.\n\nList of preconfigured base images\n---------------------------------\n\nThese images may be used directly in workstation configurations,\nor they may be used as base images when creating\n[custom container images](/workstations/docs/custom-container-images)\nwith Docker's `FROM` command.\n\nList of third-party base images\n-------------------------------\n\n| **Caution:** A third-party provider maintains the container image listed in this section. Google Cloud does not build, maintain, or officially support this image. Carefully evaluate any solution before deploying it in your production environment.\n\nIf you encounter issues with Posit Workbench IDE or with the Posit Workbench\ncontainer image, report them to Posit on\n[GitHub](https://github.com/rstudio/rstudio/issues).\n\nCloud Workstations base image structure\n---------------------------------------\n\nCloud Workstations base images share the following defined structure:\n\n- The base image entrypoint file is set to `/google/scripts/entrypoint.sh`.\n- On startup, base images run files under `/etc/workstation-startup.d/*` in\n lexicographical order to initialize the workstation environment.\n\n The files and their behavior are as follows:\n - `000_configure-docker.sh`: Configures and runs Docker inside the workstation.\n - `010_add-user.sh`: Creates the default user in Cloud Workstations.\n\n Because the persistent disk is dynamically attached to the container,\n users must be added on workstation startup, **not** in the Dockerfile.\n - `020_start-sshd.sh`: Starts the `sshd` service in the container.\n\n - `030_customize-environment.sh`: Executes `/home/user/.workstation/customize_environment` as `user`.\n\n - `110_start-$IDE.sh`: Starts the IDE for the image.\n\n- Cloud Workstations stores Docker images in the home directory at\n `/home/.docker_data` so that the images are preserved between sessions.\n\nTo add additional functionality during workstation startup, add your scripts in\nthe `/etc/workstation-startup.d/` directory:\n\n- Scripts in this directory run as root by default. To execute the scripts as\n a different user, use the `runuser` command.\n\n- Because scripts execute in lexicographical order, we recommended that you\n prefix the scripts with a three digit number that is greater than 200.\n\nAlternatively, if you don't want to extend a workstations image, you can create\na [customize_environment script](#customize-without-extending-image) in\nyour home directory.\n\n### Home directory modifications\n\nWhen the workstation configuration specifies a persistent home directory\n(which is the default behavior), a persistent disk backing the home directory\nis dynamically attached to the container at runtime. This process overwrites\nmodifications made to the `/home` directory at container image build time.\n\nTo preserve updates, modify the `/home` directory at container runtime\nby adding a script in the in the `/etc/workstation-startup.d` directory,\nor by adding per-user configuration in the `/etc/profile.d` directory.\nTo speed up the process, consider running the setup script as a background\nprocess (add an ampersand, `&`, to the end of the command) to avoid\nblocking container startup.\n\nSome examples of build time configuration that should be moved to container\nruntime:\n\n- Per-user `git` configuration\n- `git` repositories cloned in the home directory\n- Direct user configuration, such as placing files in a `$HOME/.config` directory\n- User creation\n\n### User creation and modification\n\nBecause the persistent disk dynamically attaches to the container at runtime,\nusers must be added on workstation startup, *not* in the Dockerfile. To modify\nor create additional users, we recommended that you update\n`/etc/workstation-startup.d/010_add-user.sh`, or\ncreate your own script that executes on startup.\n\nAdditionally, you can modify the default bash profile for the users by updating\nthe files in `/etc/profile.d`.\n\n### Update preconfigured Secure APT keys\n\nCloud Workstations base images come preinstalled with a number of tools obtained\nfrom various third-party repositories using Secure APT. As part of the install\nprocess, public keys provided by the repository owners are imported using `gpg`\nand placed into individual files under `/usr/share/keyrings/`. These files are\nreferenced from corresponding `list` files under `/etc/apt/sources.list.d/`.\nThis enables `apt` to verify the integrity of the a given repository when\ninteracting with it.\n\nOn occasion, third-party repository owners may decide to change the public key\nused to validate the integrity of their repository, which causes `apt` to\ndisplay an error when interacting with it. To resolve this potential problem,\nyou can use `/google/scripts/refresh-preinstalled-apt-keys.sh`, which\nobtains the latest versions of preinstalled public keys and re-imports them.\n\n### List installed IDE versions\n\nSeveral Cloud Workstations base images come preinstalled with an IDE. For\nconvenience, see the included `/google/scripts/preinstalled-ide-versions.sh`\nscript, which lists the name and version information of IDEs installed in\nthe image.\n\n### Turn off `sudo` root privileges\n\nThe default workstation user has `sudo` root access privileges in these\ncontainers. To turn off root access to the Docker container, set the\n`CLOUD_WORKSTATIONS_CONFIG_DISABLE_SUDO` environment variable\nto `true` when creating the workstation configuration.\n\nTo set this environment variable through the Google Cloud console when creating\nyour workstation configuration, follow these steps:\n\n1. When creating your workstation configuration, complete the configuration for Basic information and the Machine configuration.\n2. On the **Environment customization** dialog, expand the **Advanced container options** section and select **Environment variables**.\n3. Click add**Add variable**.\n4. Enter `CLOUD_WORKSTATIONS_CONFIG_DISABLE_SUDO` and `true` as the value.\n\n| **Note:** If a user is able to break out of the Docker container, they might be able to obtain root privileges on the underlying VM.\n\n### Customize without extending an image\n\nFor convenience all Cloud Workstations base images check for the presence of\nan executable file located at `/home/user/.workstation/customize_environment`\nand, if it exists, run it in the background as `user`. This lets you\nrun any script or binary at startup. Unlike `.profile` or `.bashrc` the script\nonly runs once when the workstation starts, rather than once for each shell\nlogin.\n\nBecause the `customize_environment` script runs as `user`, be sure to update\npermissions as necessary when writing your script. For example, if you want to\ninstall Emacs everytime your workstation starts, the content of\n`customize_environment` might be similar to the following: \n\n #!/bin/bash\n sudo apt-get update\n sudo apt-get install -y emacs\n\nExecution logs for `customize_environment` can be found in the container at\n`/var/log/customize_environment` and are also written to the\n[container output logs](/workstations/docs/container-output-logging).\nOn successful execution of `customize_environment`, a file is created in\n`/var/run/customize_environment_done`. Because `customize_environment` runs in\nparallel with Workstation startup, packages installed by the script can be\navailable as early as a few moments after your workstation has started.\n\nWhat's next\n-----------\n\n- [Customize your container images](/workstations/docs/customize-container-images).\n- [Automate container image rebuilds](/workstations/docs/tutorial-automate-container-image-rebuild) to synchronize base image updates using Cloud Build and Cloud Scheduler.\n- [Set up security best practices](/workstations/docs/set-up-security-best-practices)."]]
