[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eCloud Run functions run on versioned runtime images, maintained by Google, which include OS libraries, language runtimes, and system packages.\u003c/p\u003e\n"],["\u003cp\u003eYou can identify the specific runtime image used for your function by inspecting the build logs and searching for \u003ccode\u003egoogle.run-image\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run functions offer two security update policies: \u003ccode\u003eAutomatic updates\u003c/code\u003e, which apply updates after a stability testing period with zero downtime, and \u003ccode\u003eOn deployment updates\u003c/code\u003e, which apply updates only when a function is deployed or redeployed.\u003c/p\u003e\n"],["\u003cp\u003eYou can change the security update policy for your Cloud Run function using the \u003ccode\u003e--runtime-update-policy\u003c/code\u003e flag in the \u003ccode\u003egcloud deploy\u003c/code\u003e command, choosing between \u003ccode\u003eautomatic\u003c/code\u003e and \u003ccode\u003eon-deploy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eWhen you enable automatic updates, the updated runtime image version is visible within the runtime logs under the \u003ccode\u003eruntime_version\u003c/code\u003e label.\u003c/p\u003e\n"]]],[],null,["# Execution environment security\n==============================\n\nEvery function runs on top of a versioned [runtime image](https://cloud.google.com/docs/buildpacks/build-run-image)\nwithin the Cloud Run functions secure [execution environment](/functions/1stgendocs/concepts/execution-environment).\nRuntime images contain operating system libraries, [language runtimes](/functions/1stgendocs/concepts/execution-environment#runtimes)\nand other [system packages](/functions/docs/reference/system-packages). Google\nmaintains all Cloud Run functions runtime images, releasing security patches\nand maintenance updates after a period of stability testing.\n\nRuntime images\n--------------\n\nEach runtime has an associated runtime image (also known as a run image) in a\npublic repository on `gcr.io`. For a of list runtime IDs and their runtime images,\nsee [runtimes](/functions/1stgendocs/concepts/execution-environment#runtimes).\n\n### Identify your runtime image\n\nYou can identify the runtime image used to create your function by inspecting the\n[build logs](/functions/1stgendocs/building#view_your_build_image_logs) for your\nfunction.\n\nWithin the build logs, search for `google.run-image`. This gives you the log\nentry from the build step that describes the version of the runtime image used to\nbuild your function. For example, a log entry for a Nodejs function might look\nlike this: \n\n {\n ...\n \"textPayload\": \"Step #2 - \\\"build\\\": Adding image label google.run-image:\n us.gcr.io/serverless-runtimes/google-22-full/runtimes/nodejs20:nodejs20_20241110_20_18_0_RC00\n \",\n ...\n }\n\nSecurity update policy\n----------------------\n\nYou can choose one of the following security update policies:\n\n- **Automatic updates** (default): Updates and security patches to the runtime environment\n are published in new versions of the runtime image. After a period of testing for\n stability and reliability, the updated runtime is rolled out to all functions\n resulting in a zero downtime update. Automatic security updates are\n available with Cloud Run functions (1st gen) and Cloud Run functions. To take on language-level security fixes, you may need to rebuild functions that use compiled languages such as Go or Java.\n\n- **On deployment updates**: Updates and security patches are applied\n to runtimes only when functions are deployed or redeployed, unless\n otherwise noted. Updates on deployment are available on both\n Cloud Run functions (1st gen) and Cloud Run functions.\n\nThe runtime update policy can be changed using the `--runtime-update-policy`\n[flag](/sdk/gcloud/reference/functions/deploy#--runtime-update-policy) in your `gcloud functions deploy` command.\n\n### Set your function's update policy\n\nIf you're using Cloud Run functions (1st gen), you can change your\nfunction's update policy by including the `--runtime-update-policy` flag in\nyour `gcloud deploy` command as shown here: \n\n```sh\n gcloud functions deploy FUNCTION_NAME --no-gen2 \\\n --runtime-update-policy=POLICY ...\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e with the name of your function\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e with `automatic` or `on-deploy`\n\n### Inspect your function's update policy\n\nYou can inspect your function's update policy with the following command: \n\n```sh\n gcloud functions describe FUNCTION_NAME \\\n```\n\nWhere \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e is the name of your function\n\n- Functions with automatic security updates enabled will have the key `automaticUpdatePolicy`\n- Functions that update on deployment will have the key `onDeployUpdatePolicy`\n\n### Identify the runtime image used after an automatic update\n\nWhen you enable automatic updates, Cloud Run functions swaps your\nfunction's runtime image with a newer revision containing additional security\npatches and updates. This change appears in your function's [runtime logs](/functions/1stgendocs/monitoring/logging#viewing_runtime_logs).\n\nInside the runtime logs the `runtime_version` label tells you when a new\nruntime image is being used on your function. A log entry for a Nodejs function that\nhas been automatically updated might look like this: \n\n {\n ...\n \"labels:\" {\n runtime_version: nodejs20_20230924_20_6_1_RC00\n execution_id: ...\n }\n ...\n }"]]
