Additionally, make sure the following kernel options are enabled:
CONFIG_GVE
CONFIG_NET_VENDOR_GOOGLE
CONFIG_PCI_MSI
CONFIG_SWIOTLB
Google Virtual Network Interface Controller (gVNIC) device driver
Use version 1.01 or later of the gVNIC driver. For additional instructions, see
Using Google Virtual NIC.
NVMe interface
The NVMe interface must be available during boot on the guest operating system
for persistent disks and attached SSDs.
The kernel and initramfs image (if used) must include the NVMe driver module to
mount the root directory.
Operating system feature tags
Confidential VM instance creation requires that the image has one of the
following guest OS feature tags, depending on the Confidential Computing
technology in use:
SEV_CAPABLE
SEV_LIVE_MIGRATABLE_V2
SEV_SNP_CAPABLE
TDX_CAPABALE
The following OS feature tags should also be added:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eConfidential VM instances can be created using custom Linux images, following a similar process as standard Compute Engine custom image creation but with specific additional requirements.\u003c/p\u003e\n"],["\u003cp\u003eThe minimum kernel version for Confidential VM varies depending on the required technology: SEV needs 5.11 or later, SEV with live migration requires 6.6 or 6.1 LTS or later, and SEV-SNP or Intel TDX require 6.1LTS or later or 6.6 or later respectively.\u003c/p\u003e\n"],["\u003cp\u003eSpecific kernel options such as \u003ccode\u003eCONFIG_AMD_MEM_ENCRYPT\u003c/code\u003e, \u003ccode\u003eCONFIG_GVE\u003c/code\u003e, \u003ccode\u003eCONFIG_NET_VENDOR_GOOGLE\u003c/code\u003e, \u003ccode\u003eCONFIG_PCI_MSI\u003c/code\u003e, and \u003ccode\u003eCONFIG_SWIOTLB\u003c/code\u003e must be enabled in the kernel configuration for both AMD SEV/SEV-SNP and Intel TDX.\u003c/p\u003e\n"],["\u003cp\u003eThe gVNIC driver must be version 1.01 or later, and the NVMe interface must be available at boot with the appropriate driver included in the kernel and initramfs.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a Confidential VM instance, the image must include specific guest OS feature tags such as \u003ccode\u003eSEV_CAPABLE\u003c/code\u003e, \u003ccode\u003eSEV_LIVE_MIGRATABLE_V2\u003c/code\u003e, \u003ccode\u003eSEV_SNP_CAPABLE\u003c/code\u003e, or \u003ccode\u003eTDX_CAPABLE\u003c/code\u003e, as well as \u003ccode\u003eGVNIC\u003c/code\u003e, \u003ccode\u003eUEFI_COMPATIBLE\u003c/code\u003e, and \u003ccode\u003eVIRTIO_SCSI_MULTIQUEUE\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create custom Confidential VM images\n\nYou can create a Confidential VM instance based on your own custom Linux image.\nThis is the same process as\n[creating a custom Linux image for Compute Engine](/compute/docs/images/create-custom),\nwith additional requirements.\n\nConfidential VM custom image requirements\n-----------------------------------------\n\nMake sure to follow these requirements when building a custom image for a\nConfidential VM instance.\n\n### Linux kernel details\n\n### AMD SEV and SEV-SNP\n\nThe minimum kernel version required for Confidential VM differs depending on the\ntechnology you need.\n\n- For SEV, use kernel version 5.11 or later.\n\n- For SEV with live migration, use kernel version 6.6 or later. For long-term\n support (LTS) kernels, use version 6.1 LTS or later.\n\n- For SEV-SNP, use 6.1LTS or later.\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_AMD_MEM_ENCRYPT`\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\nIf you need to use earlier kernel versions, you might need to do additional\nwork to install device drivers.\n\n### Intel TDX\n\nFor Intel TDX support, use kernel version 6.6 or later.\n\nFor instructions on adding TDX support to a kernel, see\n[Instruction to set up TDX host and guest](https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#kernel-configuration-for-tdx-support).\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\n### Google Virtual Network Interface Controller (gVNIC) device driver\n\nUse version 1.01 or later of the gVNIC driver. For additional instructions, see\n[Using Google Virtual NIC](/compute/docs/networking/using-gvnic).\n| **Note:** Some operating systems misreport the default gVNIC driver as version 1.0, even if it's newer and works with Confidential VM. If you find the gVNIC device isn't working, upgrade the driver.\n\n### NVMe interface\n\nThe NVMe interface must be available during boot on the guest operating system\nfor persistent disks and attached SSDs.\n\nThe kernel and initramfs image (if used) must include the NVMe driver module to\nmount the root directory.\n\n### Operating system feature tags\n\nConfidential VM instance creation requires that the image has one of the\nfollowing guest OS feature tags, depending on the Confidential Computing\ntechnology in use:\n\n- `SEV_CAPABLE`\n\n- `SEV_LIVE_MIGRATABLE_V2`\n\n- `SEV_SNP_CAPABLE`\n\n- `TDX_CAPABALE`\n\nThe following OS feature tags should also be added:\n\n- `GVNIC`\n\n- `UEFI_COMPATIBLE`\n\n- `VIRTIO_SCSI_MULTIQUEUE`\n\nSee\n[Enable guest operating system features on custom images](/compute/docs/images/create-custom#guest-os-features)\nto learn how to add a tag with the `--guest-os-features` flag.\n\nWhat's next\n-----------\n\nLearn more about using [operating system images](/compute/docs/images) to create\nboot disks for Compute Engine instances."]]
