本頁面提供 Google Cloud上執行 Container-Optimized OS 的安全性功能總覽。
OS 安全性
以 Chromium OS 為基礎的 Container-Optimized OS from Google 實作多種安全防護設計原則，針對在實際工作環境中執行的服務提供設定完善的平台。
最小化 OS 佔用空間
這是 Container-Optimized OS 安全防護功能的核心所在。由於 Container-Optimized OS 已針對容器執行作業進行最佳化，而容器又封裝其依附元件，因此可清理非必要的套件，盡可能減少 OS 受攻擊的表面。
不可變更的根檔案系統及驗證開機程序
Container-Optimized OS 根檔案系統一律會以唯讀模式掛接。此外，系統會在建構期間計算其總和檢查碼，並在每次啟動時由核心進行驗證。這個機制可防範攻擊者透過永久本機變更來「接管」機器。此外，在預設情況下，其他幾個掛接作業無法執行。詳情請參閱檔案系統。
無狀態設定
雖然唯讀的根檔案系統可確保安全性，但這也會使得系統難以操作，例如需要建立並新增使用者才能登入系統的情形。為解決這個問題，我們自訂了根目錄檔案系統，讓 /etc/ 可寫入，但不具狀態。這可讓您在執行時寫入設定，但這些設定在重新啟動後就會消失。因此，每次 Container-Optimized OS 節點重新啟動時，就會從乾淨的插入畫面啟動。特定資料 (例如使用者的主目錄、記錄及 Docker 映像檔) 在重新啟動後仍會保留，這是因為這些資料並不屬於根檔案系統。
安全性強化核心
Container-Optimized OS 可啟用多項安全強化核心功能，包括完整性評估架構 (IMA)、稽核、核心頁面表格隔離 (KPTI)，以及 Chromium OS 的部分 Linux 安全模組 (LSM)。此外，Container-Optimized OS 支援 seccomp 和 AppArmor 等安全防護功能，可讓您強制執行更精細的安全性政策。
著重安全性的預設設定
Container-Optimized OS 針對多個功能提供著重安全性的預設值，提供另一個層級的功能強化。這包括停用 ptrace 與無特權 BPF，或是鎖定防火牆等作業的 sysctl 設定。這些預設值自動套用至一系列執行個體後，有助確保整個叢集、專案及機構的安全性。
自動更新
Container-Optimized OS 的自動更新功能可將安全性修補程式即時遞送至執行中的 VM。當 Kubernetes Engine 代管 Container-Optimized OS 時，節點自動升級功能會在安全性與穩定性之間取得平衡。
檔案系統
以下是 Container-Optimized OS 節點映像檔檔案系統中的路徑清單，以及其屬性和建議用法：
根據預設，Container-Optimized OS 設為捨棄通訊埠 22 上除了 SSH 以外的所有連入 TCP/UDP 連線。如要瞭解如何變更預設值以開啟更多通訊埠，請參閱設定主機防火牆。
執行個體存取權
根據預設，Container-Optimized OS 不包含任何可存取的使用者帳戶。
使用者帳戶和安全殼層金鑰可透過執行個體或專案中繼資料或 OS 登入功能進行管理。
OS 登入可讓您使用 IAM 管理執行個體的存取權。這可讓您進行更精細的存取權控管 (sudo 與非 sudo)、可辨識的 SSH 金鑰，以及組織的登入政策。
除了作業系統本身的各種強化功能，Container-Optimized OS 團隊也重視軟體供應鏈，並根據 Chromium OS 和 Google 多年的經驗，在開發、建構和部署映像檔時，將基礎架構安全性列為優先考量。
使用 Google 的原始碼建構
Container-Optimized OS 中的各個套件，包括 Linux kernel 本身，都是使用 ChromiumOS 程式碼存放區中的原始碼建構而成。這代表我們能夠清楚掌握 OS 的確切內容組成、簽入者、導入的版本等資訊。這也可以讓我們在任何層級發現安全漏洞時，快速修補並更新任何套件。
持續安全漏洞 (CVE) 掃描與回應
只要在核心或 OS 的任何套件中發現安全漏洞，CVE 掃描系統就會向我們發出警報。這個系統也用於偵測 Android 和 Chromium OS 中的安全漏洞。Container-Optimized OS 團隊會優先回應，以便發布修補版本。Container-Optimized OS 小組也會與 Google 的事件回應小組共同合作，在 Container-Optimized OS 中迅速提供涵蓋範圍更廣的安全性修補程式。
測試與資格認證程序
在將新的 Container-Optimized OS 映像檔發佈至 Google Cloud 之前，必須在各個層級進行測試，包括使用 syzkaller 的核心模糊測試、叢集層級的 Kubernetes 測試、Compute Engine 功能的整合測試，以及各種效能基準。這可確保我們發佈內容的穩定性與品質。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eContainer-Optimized OS minimizes the attack surface by having a minimal OS footprint, as it is designed primarily to run containers and trims unnecessary packages.\u003c/p\u003e\n"],["\u003cp\u003eThe root filesystem in Container-Optimized OS is immutable, mounted as read-only, and verified at boot to prevent unauthorized modifications, enhancing system integrity.\u003c/p\u003e\n"],["\u003cp\u003eContainer-Optimized OS uses a stateless configuration for settings in the \u003ccode\u003e/etc/\u003c/code\u003e directory, allowing runtime customization without persisting changes across reboots, thus starting from a clean state each time.\u003c/p\u003e\n"],["\u003cp\u003eThe OS enables several security-hardening kernel features, including IMA, Audit, KPTI, and LSMs, along with security-centric defaults like disabling ptrace and unprivileged BPF, and securing the firewall.\u003c/p\u003e\n"],["\u003cp\u003eContainer-Optimized OS ensures timely security patch delivery via automatic updates, and prioritizes infrastructure security by building from source, employing continuous vulnerability scanning, and using a rigorous testing and qualification process before image releases.\u003c/p\u003e\n"]]],[],null,["# Security Overview\n\nThis page provides an overview of the security features of\nContainer-Optimized OS running on Google Cloud.\n\nOS Security\n-----------\n\nBased on [Chromium OS](https://www.chromium.org/chromium-os), Container-Optimized OS from Google\nimplements several security design principles to provide a well-configured\nplatform for running production services.\n\n### Minimal OS footprint\n\nThis is at the core of Container-Optimized OS security. Since\nContainer-Optimized OS is optimized to run containers and containers package\ntheir own dependencies, we can trim unnecessary packages and thus minimize the\nOS attack surface.\n\n### Immutable root filesystem and verified boot\n\nThe Container-Optimized OS root filesystem is always mounted as read-only.\nAdditionally, its checksum is computed at build time and verified by the kernel\non each boot. This mechanism prevents against attackers from \"owning\" the\nmachine through permanent local changes. Additionally, several other mounts are\nnon-executable by default. See [Filesystem](#filesystem) for details.\n\n### Stateless configuration\n\nWhile having a read-only root filesystem is good for security, it makes the\nsystem difficult to use. For example, we need to be able to create and add users\nin order to log in to the system. To address this, we customize the root\nfilesystem such that `/etc/` is writable but stateless. This allows you to write\nconfiguration settings at run time, but those settings do not persist across\nreboots. Thus, every time a Container-Optimized OS node reboots, it starts from\na clean slate. Certain data, such as users' home directories, logs, and Docker\nimages, persist across reboots, as they are not part of the root filesystem.\n\n### Security-hardened kernel\n\nContainer-Optimized OS enables several security-hardening kernel features,\nincluding Integrity Measurement Architecture (IMA), Audit, Kernel Page Table\nIsolation (KPTI), and some Linux Security Modules (LSMs) from Chromium OS.\nAdditionally, Container-Optimized OS supports security features like\n[seccomp](https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt)\nand\n[AppArmor](https://gitlab.com/apparmor/apparmor/wikis/home/)\nthat make it possible to enforce finer grained security policies.\n\n### Security-centric defaults\n\nContainer-Optimized OS provides another level of hardening by providing\nsecurity-minded default values for several features. This includes things such as [sysctl\nsettings](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/master/project-lakitu/chromeos-base/chromeos-base/files/00-sysctl.conf)\nthat disable ptrace and unprivileged BPF, lock down the firewall, and so on.\nThese defaults, when automatically applied to a fleet of instances, help secure\nthe entire cluster, project, and organization.\n\n### Automatic updates\n\nContainer-Optimized OS's automatic updates feature allows timely delivery of\nsecurity patches to running VMs. When Container-Optimized OS is managed by\nKubernetes Engine,\n[node auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/node-auto-upgrades)\nstrike a balance between security and stability.\n\n### Filesystem\n\n\nThe following is a list of paths in the Container-Optimized OS node image file\nsystem, along with their properties and recommended usage:\n\n### Firewall\n\nBy default, Container-Optimized OS is configured to drop all incoming TCP/UDP\nconnections except SSH on port 22. See [Configuring the Host\nFirewall](/container-optimized-os/docs/how-to/firewall) on how to change the\ndefault to open up more ports.\n\n### Instance access\n\nBy default, Container-Optimized OS does not contain any accessible user\naccounts.\n\nUser accounts and SSH keys are managed through\n[instance or project metadata](/compute/docs/instances/adding-removing-ssh-keys)\nor [OS Login](/compute/docs/instances/managing-instance-access).\n\n\nOS Login lets you to manage access to instances using IAM. It allows for finer\ngrained access control (sudo versus non-sudo), identifiable SSH keys, and\norganizational login policy.\n\n\nThe SSH daemon is configured to disallow password-based authentication and to\ndisallow root logins.\n\nHowever, this does not prevent the users from gaining root privileges using sudo\nafter login unless the user account is managed with OS Login.\n\n\nInfrastructure Security\n-----------------------\n\nIn addition to various hardening features in the OS itself, the\nContainer-Optimized OS team also takes the software supply chain seriously and\nprioritizes infrastructure security when developing, building, and deploying\nimages, based on years of experience from both Chromium OS and Google in\ngeneral.\n\n### Built from source at Google\n\nEach package in Container-Optimized OS, including the Linux kernel itself, is\nbuilt from source from ChromiumOS code repositories. This means that we know\nexactly what is going into the OS, who checked it in, in which version it was\nintroduced, etc. This also lets us quickly patch and update any package in case\na vulnerability is discovered, at any level.\n\n### Continuous vulnerability (CVE) scanning and response\n\nA CVE-scanning system alerts us whenever a vulnerability is discovered in the\nkernel or any package of the OS. This is the same system used to detect\nvulnerabilities in Android and Chromium OS. The Container-Optimized OS team\nresponds with priority to make patched releases. The Container-Optimized OS team\nalso works with Google's incident response team to make wider security patches\navailable quickly in Container-Optimized OS.\n\n### Testing and qualification process\n\nBefore we publish a new Container-Optimized OS image to Google Cloud, we test it\nat multiple levels---including kernel fuzz testing by\n[syzkaller](https://github.com/google/syzkaller),\ncluster-level Kubernetes tests, integration testing with Compute Engine features,\nand several performance benchmarks. This ensures the stability and quality of\nour releases."]]
