자동 업데이트(기본값): 런타임 환경에 대한 업데이트 및 보안 패치가 런타임 이미지의 새 버전으로 게시됩니다. 안정성과 신뢰성을 테스트한 후 업데이트된 런타임이 모든 함수에 출시되어 다운타임 없이 업데이트됩니다. 자동 보안 업데이트는 Cloud Run Functions(1세대) 및 Cloud Run Functions에서 사용할 수 있습니다. 언어 수준의 보안 수정사항을 적용하려면 Go 또는 Java와 같은 컴파일된 언어를 사용하는 함수를 다시 빌드해야 할 수 있습니다.
배포 시 업데이트: 별도로 명시되지 않는 한 업데이트 및 보안 패치는 함수가 배포되거나 재배포될 때만 런타임에 적용됩니다. 배포 시 업데이트는 Cloud Run Functions(1세대) 및 Cloud Run Functions에서 모두 사용할 수 있습니다.
런타임 업데이트 정책은 gcloud functions deploy 명령어에서 --runtime-update-policy플래그를 사용하여 변경할 수 있습니다.
자동 보안 업데이트가 사용 설정된 함수에는 automaticUpdatePolicy 키가 있습니다.
배포 시 업데이트되는 함수에는 onDeployUpdatePolicy 키가 있습니다.
Cloud Run Functions의 보안 스캔
자동 업데이트가 사용 설정된 Cloud Run Functions는 scratch 이미지를 기반으로 빌드됩니다. 따라서 Artifact Registry에서 함수를 나타내는 컨테이너에는 기본 이미지가 없으며 배포 시 업데이트를 사용하는 함수보다 크기가 상당히 작습니다. 런타임 시 기본 이미지가 함수 이미지와 결합되어 완전한 함수가 생성됩니다. 자세한 내용은 scratch에서 빌드를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-03(UTC)"],[[["\u003cp\u003eCloud Run functions operate within a secure execution environment using versioned runtime images maintained by Google, which include operating system libraries, language runtimes, and system packages.\u003c/p\u003e\n"],["\u003cp\u003eYou can identify the specific runtime image used to build your function by searching for \u003ccode\u003egoogle.run-image\u003c/code\u003e in the build logs.\u003c/p\u003e\n"],["\u003cp\u003eThere are two security update policies for runtime environments: automatic updates, which are applied to all functions after stability testing, and on-deployment updates, which occur only when functions are deployed or redeployed.\u003c/p\u003e\n"],["\u003cp\u003eThe runtime update policy for a function can be set or changed using the \u003ccode\u003e--runtime-update-policy\u003c/code\u003e flag within the \u003ccode\u003egcloud deploy\u003c/code\u003e command, and the current policy can be inspected with \u003ccode\u003egcloud functions describe\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eFunctions with automatic updates are built on top of a \u003ccode\u003escratch\u003c/code\u003e image, resulting in a smaller container in Artifact Registry, and security scans can be performed on the Google-managed base images.\u003c/p\u003e\n"]]],[],null,["# Execution environment security\n==============================\n\nThis page provides supplemental information for security update policies on\nfunctions created using\n[`gcloud functions`](/sdk/gcloud/reference/functions) commands or the\n[Cloud Functions v2 API](/functions/docs/reference/rest).\n\nFor a detailed description of how to set automatic updates for the base images,\nincluding the language runtimes, OS package, and operating system, see the\nCloud Run document\n[Configure automatic base image updates](/run/docs/configuring/services/automatic-base-image-updates).\n\nRuntime images\n--------------\n\nEach runtime has an associated runtime image (also known as a run image) in a\npublic repository on Artifact Registry. For a list of runtime IDs and their runtime\nimages, see [runtimes](/functions/docs/runtime-support).\n\n### Identify your runtime image\n\nYou can identify the runtime image used to create your function by inspecting the\n[build logs](/functions/docs/building#view_your_build_image_logs) for your\nfunction.\n\nWithin the build logs, search for `google.run-image`. This gives you the log\nentry from the build step that describes the version of the runtime image used to\nbuild your function. For example, a log entry for a Nodejs function might look\nas follows: \n\n {\n ...\n \"textPayload\": \"Step #2 - \\\"build\\\": Adding image label google.run-image:\n us-central1-docker.pkg.dev/serverless-runtimes/google-22-full/runtimes/nodejs22:nodejs20_20230924_20_6_1_RC00\",\n ...\n }\n\nSecurity update policy\n----------------------\n\nYou can choose one of the following security update policies:\n\n- **Automatic updates** (default): Updates and security patches to the runtime environment\n are published in new versions of the runtime image. After a period of testing for\n stability and reliability, the updated runtime is rolled out to all functions\n resulting in a zero downtime update. Automatic security updates are\n available with Cloud Run functions (1st gen) and Cloud Run functions. To take on language-level security fixes, you may need to rebuild functions that use compiled languages such as Go or Java.\n\n- **On deployment updates**: Updates and security patches are applied\n to runtimes only when functions are deployed or redeployed, unless\n otherwise noted. Updates on deployment are available on both\n Cloud Run functions (1st gen) and Cloud Run functions.\n\nThe runtime update policy can be changed using the `--runtime-update-policy`\n[flag](/sdk/gcloud/reference/functions/deploy#--runtime-update-policy) in your `gcloud functions deploy` command.\n\nBy default, automatic security updates are enabled for functions deployed using:\n\n- [`gcloud functions`](/sdk/gcloud/reference/functions)\n- [Cloud Functions v2 API](/functions/docs/reference/rest)\n- [`gcloud run`](/sdk/gcloud/reference/run) with the `--functions` flag and the `--base-image` flag\n\n### Set your function's update policy\n\nYou can change your function's update policy by using the following command: \n\n```sh\n gcloud functions deploy FUNCTION_NAME \\\n --runtime-update-policy=POLICY ...\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e with the name of your function\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e with `automatic` or `on-deploy`\n\nInspect your function's update policy\n-------------------------------------\n\nYou can inspect your function's update policy with the following command: \n\n```sh\n gcloud functions describe FUNCTION_NAME \\\n```\n\nWhere \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e is the name of your function\n\n- Functions with automatic security updates enabled will have the key `automaticUpdatePolicy`\n- Functions that update on deployment will have the key `onDeployUpdatePolicy`\n\nSecurity scans on Cloud Run functions\n-------------------------------------\n\nCloud Run functions that have automatic updates enabled are built on top\nof a [`scratch` image](https://hub.docker.com/_/scratch). As a result, the\ncontainer that represents your function in Artifact Registry won't have a base image\nand will be considerably smaller than functions using on-deployment updates. The\nbase image is combined with the function image at run time to create a complete\nfunction. For more information, see\n[Build on `scratch`](/run/docs/configuring/services/automatic-base-image-updates#scratch)."]]
