自动更新（默认）：运行时环境的更新和安全补丁会在新版本的运行时映像中发布。在经过一段时间的稳定性和可靠性测试后，更新后的运行时会部署到所有函数，从而使更新停机时间为零。Cloud Run functions（第 1 代）和 Cloud Run functions 提供自动安全更新。如需进行语言级安全修复，您可能需要重新构建使用编译语言（如 Go 或 Java）的函数。
在部署更新时：除非另有说明，否则更新或安全补丁仅在部署或重新部署函数时应用于运行时。部署时更新同时适用于 Cloud Run functions（第 1 代）和 Cloud Run functions。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eCloud Run functions operate within a secure execution environment using versioned runtime images maintained by Google, which include operating system libraries, language runtimes, and system packages.\u003c/p\u003e\n"],["\u003cp\u003eYou can identify the specific runtime image used to build your function by searching for \u003ccode\u003egoogle.run-image\u003c/code\u003e in the build logs.\u003c/p\u003e\n"],["\u003cp\u003eThere are two security update policies for runtime environments: automatic updates, which are applied to all functions after stability testing, and on-deployment updates, which occur only when functions are deployed or redeployed.\u003c/p\u003e\n"],["\u003cp\u003eThe runtime update policy for a function can be set or changed using the \u003ccode\u003e--runtime-update-policy\u003c/code\u003e flag within the \u003ccode\u003egcloud deploy\u003c/code\u003e command, and the current policy can be inspected with \u003ccode\u003egcloud functions describe\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eFunctions with automatic updates are built on top of a \u003ccode\u003escratch\u003c/code\u003e image, resulting in a smaller container in Artifact Registry, and security scans can be performed on the Google-managed base images.\u003c/p\u003e\n"]]],[],null,["# Execution environment security\n==============================\n\nThis page provides supplemental information for security update policies on\nfunctions created using\n[`gcloud functions`](/sdk/gcloud/reference/functions) commands or the\n[Cloud Functions v2 API](/functions/docs/reference/rest).\n\nFor a detailed description of how to set automatic updates for the base images,\nincluding the language runtimes, OS package, and operating system, see the\nCloud Run document\n[Configure automatic base image updates](/run/docs/configuring/services/automatic-base-image-updates).\n\nRuntime images\n--------------\n\nEach runtime has an associated runtime image (also known as a run image) in a\npublic repository on Artifact Registry. For a list of runtime IDs and their runtime\nimages, see [runtimes](/functions/docs/runtime-support).\n\n### Identify your runtime image\n\nYou can identify the runtime image used to create your function by inspecting the\n[build logs](/functions/docs/building#view_your_build_image_logs) for your\nfunction.\n\nWithin the build logs, search for `google.run-image`. This gives you the log\nentry from the build step that describes the version of the runtime image used to\nbuild your function. For example, a log entry for a Nodejs function might look\nas follows: \n\n {\n ...\n \"textPayload\": \"Step #2 - \\\"build\\\": Adding image label google.run-image:\n us-central1-docker.pkg.dev/serverless-runtimes/google-22-full/runtimes/nodejs22:nodejs20_20230924_20_6_1_RC00\",\n ...\n }\n\nSecurity update policy\n----------------------\n\nYou can choose one of the following security update policies:\n\n- **Automatic updates** (default): Updates and security patches to the runtime environment\n are published in new versions of the runtime image. After a period of testing for\n stability and reliability, the updated runtime is rolled out to all functions\n resulting in a zero downtime update. Automatic security updates are\n available with Cloud Run functions (1st gen) and Cloud Run functions. To take on language-level security fixes, you may need to rebuild functions that use compiled languages such as Go or Java.\n\n- **On deployment updates**: Updates and security patches are applied\n to runtimes only when functions are deployed or redeployed, unless\n otherwise noted. Updates on deployment are available on both\n Cloud Run functions (1st gen) and Cloud Run functions.\n\nThe runtime update policy can be changed using the `--runtime-update-policy`\n[flag](/sdk/gcloud/reference/functions/deploy#--runtime-update-policy) in your `gcloud functions deploy` command.\n\nBy default, automatic security updates are enabled for functions deployed using:\n\n- [`gcloud functions`](/sdk/gcloud/reference/functions)\n- [Cloud Functions v2 API](/functions/docs/reference/rest)\n- [`gcloud run`](/sdk/gcloud/reference/run) with the `--functions` flag and the `--base-image` flag\n\n### Set your function's update policy\n\nYou can change your function's update policy by using the following command: \n\n```sh\n gcloud functions deploy FUNCTION_NAME \\\n --runtime-update-policy=POLICY ...\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e with the name of your function\n- \u003cvar translate=\"no\"\u003ePOLICY\u003c/var\u003e with `automatic` or `on-deploy`\n\nInspect your function's update policy\n-------------------------------------\n\nYou can inspect your function's update policy with the following command: \n\n```sh\n gcloud functions describe FUNCTION_NAME \\\n```\n\nWhere \u003cvar translate=\"no\"\u003eFUNCTION_NAME\u003c/var\u003e is the name of your function\n\n- Functions with automatic security updates enabled will have the key `automaticUpdatePolicy`\n- Functions that update on deployment will have the key `onDeployUpdatePolicy`\n\nSecurity scans on Cloud Run functions\n-------------------------------------\n\nCloud Run functions that have automatic updates enabled are built on top\nof a [`scratch` image](https://hub.docker.com/_/scratch). As a result, the\ncontainer that represents your function in Artifact Registry won't have a base image\nand will be considerably smaller than functions using on-deployment updates. The\nbase image is combined with the function image at run time to create a complete\nfunction. For more information, see\n[Build on `scratch`](/run/docs/configuring/services/automatic-base-image-updates#scratch)."]]
