[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eConfidential VM instances can be created using custom Linux images, following a similar process as standard Compute Engine custom image creation but with specific additional requirements.\u003c/p\u003e\n"],["\u003cp\u003eThe minimum kernel version for Confidential VM varies depending on the required technology: SEV needs 5.11 or later, SEV with live migration requires 6.6 or 6.1 LTS or later, and SEV-SNP or Intel TDX require 6.1LTS or later or 6.6 or later respectively.\u003c/p\u003e\n"],["\u003cp\u003eSpecific kernel options such as \u003ccode\u003eCONFIG_AMD_MEM_ENCRYPT\u003c/code\u003e, \u003ccode\u003eCONFIG_GVE\u003c/code\u003e, \u003ccode\u003eCONFIG_NET_VENDOR_GOOGLE\u003c/code\u003e, \u003ccode\u003eCONFIG_PCI_MSI\u003c/code\u003e, and \u003ccode\u003eCONFIG_SWIOTLB\u003c/code\u003e must be enabled in the kernel configuration for both AMD SEV/SEV-SNP and Intel TDX.\u003c/p\u003e\n"],["\u003cp\u003eThe gVNIC driver must be version 1.01 or later, and the NVMe interface must be available at boot with the appropriate driver included in the kernel and initramfs.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating a Confidential VM instance, the image must include specific guest OS feature tags such as \u003ccode\u003eSEV_CAPABLE\u003c/code\u003e, \u003ccode\u003eSEV_LIVE_MIGRATABLE_V2\u003c/code\u003e, \u003ccode\u003eSEV_SNP_CAPABLE\u003c/code\u003e, or \u003ccode\u003eTDX_CAPABLE\u003c/code\u003e, as well as \u003ccode\u003eGVNIC\u003c/code\u003e, \u003ccode\u003eUEFI_COMPATIBLE\u003c/code\u003e, and \u003ccode\u003eVIRTIO_SCSI_MULTIQUEUE\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Create custom Confidential VM images\n\nYou can create a Confidential VM instance based on your own custom Linux image.\nThis is the same process as\n[creating a custom Linux image for Compute Engine](/compute/docs/images/create-custom),\nwith additional requirements.\n\nConfidential VM custom image requirements\n-----------------------------------------\n\nMake sure to follow these requirements when building a custom image for a\nConfidential VM instance.\n\n### Linux kernel details\n\n### AMD SEV and SEV-SNP\n\nThe minimum kernel version required for Confidential VM differs depending on the\ntechnology you need.\n\n- For SEV, use kernel version 5.11 or later.\n\n- For SEV with live migration, use kernel version 6.6 or later. For long-term\n support (LTS) kernels, use version 6.1 LTS or later.\n\n- For SEV-SNP, use 6.1LTS or later.\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_AMD_MEM_ENCRYPT`\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\nIf you need to use earlier kernel versions, you might need to do additional\nwork to install device drivers.\n\n### Intel TDX\n\nFor Intel TDX support, use kernel version 6.6 or later.\n\nFor instructions on adding TDX support to a kernel, see\n[Instruction to set up TDX host and guest](https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#kernel-configuration-for-tdx-support).\n\nAdditionally, make sure the following kernel options are enabled:\n\n- `CONFIG_GVE`\n\n- `CONFIG_NET_VENDOR_GOOGLE`\n\n- `CONFIG_PCI_MSI`\n\n- `CONFIG_SWIOTLB`\n\n### Google Virtual Network Interface Controller (gVNIC) device driver\n\nUse version 1.01 or later of the gVNIC driver. For additional instructions, see\n[Using Google Virtual NIC](/compute/docs/networking/using-gvnic).\n| **Note:** Some operating systems misreport the default gVNIC driver as version 1.0, even if it's newer and works with Confidential VM. If you find the gVNIC device isn't working, upgrade the driver.\n\n### NVMe interface\n\nThe NVMe interface must be available during boot on the guest operating system\nfor persistent disks and attached SSDs.\n\nThe kernel and initramfs image (if used) must include the NVMe driver module to\nmount the root directory.\n\n### Operating system feature tags\n\nConfidential VM instance creation requires that the image has one of the\nfollowing guest OS feature tags, depending on the Confidential Computing\ntechnology in use:\n\n- `SEV_CAPABLE`\n\n- `SEV_LIVE_MIGRATABLE_V2`\n\n- `SEV_SNP_CAPABLE`\n\n- `TDX_CAPABALE`\n\nThe following OS feature tags should also be added:\n\n- `GVNIC`\n\n- `UEFI_COMPATIBLE`\n\n- `VIRTIO_SCSI_MULTIQUEUE`\n\nSee\n[Enable guest operating system features on custom images](/compute/docs/images/create-custom#guest-os-features)\nto learn how to add a tag with the `--guest-os-features` flag.\n\nWhat's next\n-----------\n\nLearn more about using [operating system images](/compute/docs/images) to create\nboot disks for Compute Engine instances."]]
