默认情况下，Container-Optimized OS 配置为丢弃端口 22 上 SSH 之外的所有传入 TCP/UDP 连接。请参阅配置主机防火墙，了解如何更改默认设置以打开更多端口。
实例访问权限
默认情况下，Container-Optimized OS 不包含任何可访问的用户账号。 用户账号和 SSH 密钥通过实例或项目元数据或 OS Login 进行管理。 借助 OS Login，您可以使用 IAM 管理对实例的访问权限。它允许更精细地控制访问权限（sudo 与非 sudo）、可识别的 SSH 密钥和组织登录政策。
除了操作系统本身的各种安全强化功能之外，Container-Optimized OS 团队还依托于源自 Chromium OS 和 Google 整体工作的多年经验，在开发、构建和部署映像时非常重视软件供应链并确定基础架构安全的优先级。
根据 Google 的源代码构建
Container-Optimized OS 中的每个程序包（包括 Linux 内核本身）都是使用 ChromiumOS 代码库中的源代码构建的。这意味着我们确切地了解纳入操作系统的内容、签入代码的人员、所引入的具体版本等。这也让我们可以在发现处于任何层级上的漏洞时快速修补和更新任何程序包。
持续漏洞 (CVE) 扫描和响应
每当在操作系统的内核或任何程序包中发现漏洞时，CVE 扫描系统都会提醒我们注意。这个系统也是用于检测 Android 和 Chromium OS 中漏洞的系统。Container-Optimized OS 团队会按照优先级作出响应，制作带有补丁程序的版本。Container-Optimized OS 团队还与 Google 的事件响应团队合作，在 Container-Optimized OS 中快速提供更广泛的安全补丁程序。
测试和资格审查流程
在我们将 Container-Optimized OS 映像发布到 Google Cloud 之前，会在多个层级上执行测试 - 包括 syzkaller 执行的内核模糊测试、集群层级的 Kubernetes 测试、Compute Engine 特性的集成测试以及多项性能基准测试。这能确保我们各个版本的稳定性和质量。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eContainer-Optimized OS minimizes the attack surface by having a minimal OS footprint, as it is designed primarily to run containers and trims unnecessary packages.\u003c/p\u003e\n"],["\u003cp\u003eThe root filesystem in Container-Optimized OS is immutable, mounted as read-only, and verified at boot to prevent unauthorized modifications, enhancing system integrity.\u003c/p\u003e\n"],["\u003cp\u003eContainer-Optimized OS uses a stateless configuration for settings in the \u003ccode\u003e/etc/\u003c/code\u003e directory, allowing runtime customization without persisting changes across reboots, thus starting from a clean state each time.\u003c/p\u003e\n"],["\u003cp\u003eThe OS enables several security-hardening kernel features, including IMA, Audit, KPTI, and LSMs, along with security-centric defaults like disabling ptrace and unprivileged BPF, and securing the firewall.\u003c/p\u003e\n"],["\u003cp\u003eContainer-Optimized OS ensures timely security patch delivery via automatic updates, and prioritizes infrastructure security by building from source, employing continuous vulnerability scanning, and using a rigorous testing and qualification process before image releases.\u003c/p\u003e\n"]]],[],null,["# Security Overview\n\nThis page provides an overview of the security features of\nContainer-Optimized OS running on Google Cloud.\n\nOS Security\n-----------\n\nBased on [Chromium OS](https://www.chromium.org/chromium-os), Container-Optimized OS from Google\nimplements several security design principles to provide a well-configured\nplatform for running production services.\n\n### Minimal OS footprint\n\nThis is at the core of Container-Optimized OS security. Since\nContainer-Optimized OS is optimized to run containers and containers package\ntheir own dependencies, we can trim unnecessary packages and thus minimize the\nOS attack surface.\n\n### Immutable root filesystem and verified boot\n\nThe Container-Optimized OS root filesystem is always mounted as read-only.\nAdditionally, its checksum is computed at build time and verified by the kernel\non each boot. This mechanism prevents against attackers from \"owning\" the\nmachine through permanent local changes. Additionally, several other mounts are\nnon-executable by default. See [Filesystem](#filesystem) for details.\n\n### Stateless configuration\n\nWhile having a read-only root filesystem is good for security, it makes the\nsystem difficult to use. For example, we need to be able to create and add users\nin order to log in to the system. To address this, we customize the root\nfilesystem such that `/etc/` is writable but stateless. This allows you to write\nconfiguration settings at run time, but those settings do not persist across\nreboots. Thus, every time a Container-Optimized OS node reboots, it starts from\na clean slate. Certain data, such as users' home directories, logs, and Docker\nimages, persist across reboots, as they are not part of the root filesystem.\n\n### Security-hardened kernel\n\nContainer-Optimized OS enables several security-hardening kernel features,\nincluding Integrity Measurement Architecture (IMA), Audit, Kernel Page Table\nIsolation (KPTI), and some Linux Security Modules (LSMs) from Chromium OS.\nAdditionally, Container-Optimized OS supports security features like\n[seccomp](https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt)\nand\n[AppArmor](https://gitlab.com/apparmor/apparmor/wikis/home/)\nthat make it possible to enforce finer grained security policies.\n\n### Security-centric defaults\n\nContainer-Optimized OS provides another level of hardening by providing\nsecurity-minded default values for several features. This includes things such as [sysctl\nsettings](https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/master/project-lakitu/chromeos-base/chromeos-base/files/00-sysctl.conf)\nthat disable ptrace and unprivileged BPF, lock down the firewall, and so on.\nThese defaults, when automatically applied to a fleet of instances, help secure\nthe entire cluster, project, and organization.\n\n### Automatic updates\n\nContainer-Optimized OS's automatic updates feature allows timely delivery of\nsecurity patches to running VMs. When Container-Optimized OS is managed by\nKubernetes Engine,\n[node auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/node-auto-upgrades)\nstrike a balance between security and stability.\n\n### Filesystem\n\n\nThe following is a list of paths in the Container-Optimized OS node image file\nsystem, along with their properties and recommended usage:\n\n### Firewall\n\nBy default, Container-Optimized OS is configured to drop all incoming TCP/UDP\nconnections except SSH on port 22. See [Configuring the Host\nFirewall](/container-optimized-os/docs/how-to/firewall) on how to change the\ndefault to open up more ports.\n\n### Instance access\n\nBy default, Container-Optimized OS does not contain any accessible user\naccounts.\n\nUser accounts and SSH keys are managed through\n[instance or project metadata](/compute/docs/instances/adding-removing-ssh-keys)\nor [OS Login](/compute/docs/instances/managing-instance-access).\n\n\nOS Login lets you to manage access to instances using IAM. It allows for finer\ngrained access control (sudo versus non-sudo), identifiable SSH keys, and\norganizational login policy.\n\n\nThe SSH daemon is configured to disallow password-based authentication and to\ndisallow root logins.\n\nHowever, this does not prevent the users from gaining root privileges using sudo\nafter login unless the user account is managed with OS Login.\n\n\nInfrastructure Security\n-----------------------\n\nIn addition to various hardening features in the OS itself, the\nContainer-Optimized OS team also takes the software supply chain seriously and\nprioritizes infrastructure security when developing, building, and deploying\nimages, based on years of experience from both Chromium OS and Google in\ngeneral.\n\n### Built from source at Google\n\nEach package in Container-Optimized OS, including the Linux kernel itself, is\nbuilt from source from ChromiumOS code repositories. This means that we know\nexactly what is going into the OS, who checked it in, in which version it was\nintroduced, etc. This also lets us quickly patch and update any package in case\na vulnerability is discovered, at any level.\n\n### Continuous vulnerability (CVE) scanning and response\n\nA CVE-scanning system alerts us whenever a vulnerability is discovered in the\nkernel or any package of the OS. This is the same system used to detect\nvulnerabilities in Android and Chromium OS. The Container-Optimized OS team\nresponds with priority to make patched releases. The Container-Optimized OS team\nalso works with Google's incident response team to make wider security patches\navailable quickly in Container-Optimized OS.\n\n### Testing and qualification process\n\nBefore we publish a new Container-Optimized OS image to Google Cloud, we test it\nat multiple levels---including kernel fuzz testing by\n[syzkaller](https://github.com/google/syzkaller),\ncluster-level Kubernetes tests, integration testing with Compute Engine features,\nand several performance benchmarks. This ensures the stability and quality of\nour releases."]]
