모든 함수는 Cloud Run Functions 보안 실행 환경 내에서 버전이 지정된 런타임 이미지를 기반으로 실행됩니다.
런타임 이미지에는 운영체제 라이브러리, 언어 런타임, 기타 시스템 패키지가 포함됩니다. Google에서는 모든 Cloud Run Functions 런타임 이미지를 유지하여 일정 기간 동안 안정성 테스트를 마친 후 보안 패치와 유지보수 업데이트를 출시합니다.
런타임 이미지
각 런타임에는 gcr.io의 공개 저장소에 연결된 런타임 이미지(실행 이미지라고도 함)가 있습니다. 런타임 ID 및 런타임 이미지 목록은 런타임을 참조하세요.
런타임 이미지 식별
함수의 빌드 로그를 검사하여 함수를 만드는 데 사용되는 런타임 이미지를 식별할 수 있습니다.
빌드 로그 내에서 google.run-image를 검색합니다. 그러면 함수를 빌드하는 데 사용되는 런타임 이미지 버전을 설명하는 빌드 단계의 로그 항목이 제공됩니다. 예를 들어 Nodejs 함수의 로그 항목은 다음과 같습니다.
자동 업데이트(기본값): 런타임 환경에 대한 업데이트 및 보안 패치가 런타임 이미지의 새 버전으로 게시됩니다. 안정성과 신뢰성을 테스트한 후 업데이트된 런타임이 모든 함수에 출시되어 다운타임 없이 업데이트됩니다. 자동 보안 업데이트는 Cloud Run Functions(1세대) 및 Cloud Run Functions에서 사용할 수 있습니다. 언어 수준의 보안 수정사항을 적용하려면 Go 또는 Java와 같은 컴파일된 언어를 사용하는 함수를 다시 빌드해야 할 수 있습니다.
배포 시 업데이트: 별도로 명시되지 않는 한 업데이트 및 보안 패치는 함수가 배포되거나 재배포될 때만 런타임에 적용됩니다. 배포 시 업데이트는 Cloud Run Functions(1세대) 및 Cloud Run Functions에서 모두 사용할 수 있습니다.
런타임 업데이트 정책은 gcloud functions deploy 명령어에서 --runtime-update-policy플래그를 사용하여 변경할 수 있습니다.
함수의 업데이트 정책 설정
Cloud Run Functions(1세대)를 사용하는 경우 아래와 같이 gcloud deploy 명령어에 --runtime-update-policy 플래그를 포함하여 함수의 업데이트 정책을 변경할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[[["\u003cp\u003eCloud Run functions run on versioned runtime images, maintained by Google, which include OS libraries, language runtimes, and system packages.\u003c/p\u003e\n"],["\u003cp\u003eYou can identify the specific runtime image used for your function by inspecting the build logs and searching for \u003ccode\u003egoogle.run-image\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run functions offer two security update policies: \u003ccode\u003eAutomatic updates\u003c/code\u003e, which apply updates after a stability testing period with zero downtime, and \u003ccode\u003eOn deployment updates\u003c/code\u003e, which apply updates only when a function is deployed or redeployed.\u003c/p\u003e\n"],["\u003cp\u003eYou can change the security update policy for your Cloud Run function using the \u003ccode\u003e--runtime-update-policy\u003c/code\u003e flag in the \u003ccode\u003egcloud deploy\u003c/code\u003e command, choosing between \u003ccode\u003eautomatic\u003c/code\u003e and \u003ccode\u003eon-deploy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eWhen you enable automatic updates, the updated runtime image version is visible within the runtime logs under the \u003ccode\u003eruntime_version\u003c/code\u003e label.\u003c/p\u003e\n"]]],[],null,["# Execution environment security\n==============================\n\nEvery function runs on top of a versioned [runtime image](https://cloud.google.com/docs/buildpacks/build-run-image)\nwithin the Cloud Run functions secure [execution environment](/functions/1stgendocs/concepts/execution-environment).\nRuntime images contain operating system libraries, [language runtimes](/functions/1stgendocs/concepts/execution-environment#runtimes)\nand other [system packages](/functions/docs/reference/system-packages). Google\nmaintains all Cloud Run functions runtime images, releasing security patches\nand maintenance updates after a period of stability testing.\n\nRuntime images\n--------------\n\nEach runtime has an associated runtime image (also known as a run image) in a\npublic repository on `gcr.io`. For a of list runtime IDs and their runtime images,\nsee [runtimes](/functions/1stgendocs/concepts/execution-environment#runtimes).\n\n### Identify your runtime image\n\nYou can identify the runtime image used to create your function by inspecting the\n[build logs](/functions/1stgendocs/building#view_your_build_image_logs) for your\nfunction.\n\nWithin the build logs, search for `google.run-image`. This gives you the log\nentry from the build step that describes the version of the runtime image used to\nbuild your function. For example, a log entry for a Nodejs function might look\nlike this: \n\n {\n ...\n \"textPayload\": \"Step #2 - \\\"build\\\": Adding image label google.run-image:\n us.gcr.io/serverless-runtimes/google-22-full/runtimes/nodejs20:nodejs20_20241110_20_18_0_RC00\n \",\n ...\n }\n\nSecurity update policy\n----------------------\n\nYou can choose one of the following security update policies:\n\n- **Automatic updates** (default): Updates and security patches to the runtime environment\n are published in new versions of the runtime image. After a period of testing for\n stability and reliability, the updated runtime is rolled out to all functions\n resulting in a zero downtime update. Automatic security updates are\n available with Cloud Run functions (1st gen) and Cloud Run functions. To take on language-level security fixes, you may need to rebuild functions that use compiled languages such as Go or Java.\n\n- **On deployment updates**: Updates and security patches are applied\n to runtimes only when functions are deployed or redeployed, unless\n otherwise noted. Updates on deployment are available on both\n Cloud Run functions (1st gen) and Cloud Run functions.\n\nThe runtime update policy can be changed using the `--runtime-update-policy`\n[flag](/sdk/gcloud/reference/functions/deploy#--runtime-update-policy) in your `gcloud functions deploy` command.\n\n### Set your function's update policy\n\nIf you're using Cloud Run functions (1st gen), you can change your\nfunction's update policy by including the `--runtime-update-policy` flag in\nyour `gcloud deploy` command as shown here: \n\n```sh\n gcloud functions deploy FUNCTION_NAME --no-gen2 \\\n --runtime-update-policy=POLICY ...\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e with the name of your function\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e with `automatic` or `on-deploy`\n\n### Inspect your function's update policy\n\nYou can inspect your function's update policy with the following command: \n\n```sh\n gcloud functions describe FUNCTION_NAME \\\n```\n\nWhere \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e is the name of your function\n\n- Functions with automatic security updates enabled will have the key `automaticUpdatePolicy`\n- Functions that update on deployment will have the key `onDeployUpdatePolicy`\n\n### Identify the runtime image used after an automatic update\n\nWhen you enable automatic updates, Cloud Run functions swaps your\nfunction's runtime image with a newer revision containing additional security\npatches and updates. This change appears in your function's [runtime logs](/functions/1stgendocs/monitoring/logging#viewing_runtime_logs).\n\nInside the runtime logs the `runtime_version` label tells you when a new\nruntime image is being used on your function. A log entry for a Nodejs function that\nhas been automatically updated might look like this: \n\n {\n ...\n \"labels:\" {\n runtime_version: nodejs20_20230924_20_6_1_RC00\n execution_id: ...\n }\n ...\n }"]]
