Verified boot

In Container-Optimized OS, the Linux kernel and the root filesystem (rootfs) are configured such that the kernel verifies the integrity of the rootfs during boot up. It does so by computing the checksum of the rootfs and comparing it against the approved Container-Optimized OS checksum computed at build time. In case of a mismatch, the kernel panics with an error message indicating the rootfs verification failed. This mechanism prevents against attackers from "owning" the machine through permanent local changes.


The root filesystem ("/") is mounted as read-only with some portions of it re-mounted as writable, as follows:

  • /tmp, /run, /media, /mnt/disks and /var/lib/cloud are all mounted using tmpfs and, while they are writable, their contents are not preserved between reboots.

  • Directories /mnt/stateful_partition, /var and /home are mounted from a stateful disk partition, which means these locations can be used to store data that persists across reboots. For example, Docker's working directory /var/lib/docker is stateful across reboots.

  • Among the writable locations, only /var/lib/docker and /var/lib/cloud are mounted as "executable" (i.e. without the noexec mount flag).


By default Container-Optimized OS is configured to drop all incoming TCP/UDP connections except SSH on port 22.

User management

By default Container-Optimized OS does not contain accessible user accounts. New accounts can be added via cloud-init metadata. You can also add SSH public keys which will be read by google-accounts-manager daemon running on Container-Optimized Image.

sshd is configured to disallow password authentication, i.e., one should authenticate using SSH public keys. No root logins are allowed through SSH. All users added by google-accounts-manager get sudo access.

System updates

Container-Optimized OS is capable of auto updates. This mechanism can be used to update a fleet of Compute Engine instances.

Send feedback about...

Container-Optimized OS