gcloud compute images create - create Compute Engine images

gcloud compute images createIMAGE_NAME(--source-disk=SOURCE_DISK    |--source-image=SOURCE_IMAGE    |--source-image-family=SOURCE_IMAGE_FAMILY    |--source-snapshot=SOURCE_SNAPSHOT    |--source-uri=SOURCE_URI)[--architecture=ARCHITECTURE][--csek-key-file=FILE][--description=DESCRIPTION][--family=FAMILY][--forbidden-database-file=[DBX_VALUE,…]][--force][--guest-os-features=[GUEST_OS_FEATURE,…]][--key-exchange-key-file=[KEK_VALUE,…]][--labels=[KEY=VALUE,…]][--licenses=[LICENSES,…]][--platform-key-file=PLATFORM_KEY_FILE][--no-require-csek-key-create][--signature-database-file=[DB_VALUE,…]][--source-disk-project=SOURCE_DISK_PROJECT][--source-disk-zone=SOURCE_DISK_ZONE][--source-image-project=SOURCE_IMAGE_PROJECT][--storage-location=LOCATION][--kms-key=KMS_KEY :--kms-keyring=KMS_KEYRING--kms-location=KMS_LOCATION--kms-project=KMS_PROJECT][GCLOUD_WIDE_FLAG …]

Images can be created from gzipped compressed tarball containing raw disk data,existing disks in any zone, existing images, and existing snapshots inside thesame project.

Images are global resources, so they can be used across zones and projects.

To learn more about creating image tarballs, visithttps://cloud.google.com/compute/docs/creating-custom-image.

gcloudcomputeimagescreatemy-image--source-disk=my-disk--source-disk-zone=us-east1-a

To create an image 'my-image' from a disk 'my-disk' in zone 'us-east1-a' withsource disk project 'source-disk-project' run:

gcloudcomputeimagescreatemy-image--source-disk=my-disk--source-disk-zone=us-east1-a--source-disk-project=source-disk-project

To create an image 'my-image' from another image 'source-image' with sourceimage project 'source-image-project', run:

gcloudcomputeimagescreatemy-image--source-image=source-image--source-image-project=source-image-project

To create an image 'my-image' from the latest non-deprecated image in the family'source-image-family' with source image project 'source-image-project', run:

gcloudcomputeimagescreatemy-image--source-image-family=source-image-family--source-image-project=source-image-project

To create an image 'my-image' from a snapshot 'source-snapshot', run:

gcloudcomputeimagescreatemy-image--source-snapshot=source-snapshot

IMAGE_NAME

Name of the disk image to create.

Exactly one of these must be specified:

--source-disk=SOURCE_DISK

A source disk to create the image from. The value for this option can be thename of a disk with the zone specified via--source-disk-zone flag.

--source-image=SOURCE_IMAGE

The name of an image to clone. May be used with--source-image-project to clone an image ina different project.

--source-image-family=SOURCE_IMAGE_FAMILY

The family of the source image. This will cause the latest non- deprecated imagein the family to be used as the source image. May be used with--source-image-project to refer to an imagefamily in a different project.

--source-snapshot=SOURCE_SNAPSHOT

A source snapshot to create the image from. The value for this option can be thename of a snapshot within the same project as the destination image.

--source-uri=SOURCE_URI

The full Cloud Storage URI where the disk image is stored. This file must be agzip-compressed tarball whose name ends in.tar.gz. For more information about CloudStorage URIs, seehttps://cloud.google.com/storage/docs/request-endpoints#json-api.

--architecture=ARCHITECTURE

Specifies the architecture or processor type that this image can support. Foravailable processor types on Compute Engine, seehttps://cloud.google.com/compute/docs/cpu-platforms.ARCHITECTURE must be one of:ARM64,X86_64.

--csek-key-file=FILE

Path to a Customer-Supplied Encryption Key (CSEK) key file that maps ComputeEngine images to user managed keys to be used when creating, mounting, or takingsnapshots of disks.

If you pass- as value of the flag, the CSEK is read from stdin.Seehttps://cloud.google.com/compute/docs/disks/customer-supplied-encryptionfor more details.

--description=DESCRIPTION

An optional, textual description for the image being created.

--family=FAMILY

The family of the image. When creating an instance or disk, specifying a familywill cause the latest non-deprecated image in the family to be used.

--forbidden-database-file=[DBX_VALUE,…]

Comma-separated list of file paths that point to revoked X.509 certificates inDER format or raw binary files. When you create a Shielded VM instance from thisimage, these certificates or files are added to the forbidden signature database(dbx).

--force

By default, image creation fails when it is created from a disk that is attachedto a running instance. When this flag is used, image creation from disk willproceed even if the disk is in use.

--guest-os-features=[GUEST_OS_FEATURE,…]

Enables one or more features for VM instances that use the image for their bootdisks. See the descriptions of supported features at:https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.GUEST_OS_FEATURE must be one of:BARE_METAL_LINUX_COMPATIBLE,GVNIC,IDPF,MULTI_IP_SUBNET,SEV_CAPABLE,SEV_LIVE_MIGRATABLE,SEV_LIVE_MIGRATABLE_V2,SEV_SNP_CAPABLE,SNP_SVSM_CAPABLE,TDX_CAPABLE,UEFI_COMPATIBLE,VIRTIO_SCSI_MULTIQUEUE,WINDOWS.

--key-exchange-key-file=[KEK_VALUE,…]

Comma-separated list of file paths that point to X.509 certificates in DERformat or raw binary files. When you create a Shielded VM instance from thisimage, these certificates or files are used as key exchange keys (KEK).

--labels=[KEY=VALUE,…]

List of label KEY=VALUE pairs to add.

Keys must start with a lowercase character and contain only hyphens(-), underscores (_), lowercase characters, andnumbers. Values must contain only hyphens (-), underscores(_), lowercase characters, and numbers.

--licenses=[LICENSES,…]

Comma-separated list of URIs to license resources.

--platform-key-file=PLATFORM_KEY_FILE

File path that points to an X.509 certificate in DER format or raw binary file.When you create a Shielded VM instance from this image, this certificate or rawbinary file is used as the platform key (PK).

--require-csek-key-create

Refuse to create images not protected by a user managed key in the key file when--csek-key-file is given. This behavior is enabled by default to preventincorrect gcloud invocations from accidentally creating images with no usermanaged key. Disabling the check allows creation of some images without amatching Customer-Supplied Encryption Key in the supplied --csek-key-file. Seehttps://cloud.google.com/compute/docs/disks/customer-supplied-encryptionfor more details. Enabled by default, use--no-require-csek-key-create to disable.

--signature-database-file=[DB_VALUE,…]

Comma-separated list of file paths that point to valid X.509 certificates in DERformat or raw binary files. When you create a Shielded VM instance from thisimage, these certificates or files are added to the signature database (db).

--source-disk-project=SOURCE_DISK_PROJECT

Project name of the source disk. Must also specify --source-disk when using thisflag.

--source-disk-zone=SOURCE_DISK_ZONE

Zone of the source disk to operate on. If not specified and thecompute/zone property isn't set, you mightbe prompted to select a zone (interactive mode only).

To avoid prompting when this flag is omitted, you can set thecompute/zone property:

gcloudconfigsetcompute/zoneZONE

A list of zones can be fetched by running:

gcloudcomputezoneslist

To unset the property, run:

gcloudconfigunsetcompute/zone

Alternatively, the zone can be stored in the environment variableCLOUDSDK_COMPUTE_ZONE.

--source-image-project=SOURCE_IMAGE_PROJECT

The project name of the source image. Must also specify either--source-image or--source-image-family when using this flag.

--storage-location=LOCATION

Specifies a Cloud Storage location, either regional or multi-regional, whereimage content is to be stored. If not specified, the multi-region locationclosest to the source is chosen automatically.

Key resource - The Cloud KMS (Key Management Service) cryptokey that will beused to protect the image. The 'Compute Engine Service Agent' service accountmust hold permission 'Cloud KMS CryptoKey Encrypter/Decrypter'. The arguments inthis group can be used to specify the attributes of this resource.

--kms-key=KMS_KEY

ID of the key or fully qualified identifier for the key.

To set thekms-key attribute:

• provide the argument--kms-key on the command line.

This flag argument must be specified if any of the other arguments in this groupare specified.

--kms-keyring=KMS_KEYRING

The KMS keyring of the key.

To set thekms-keyring attribute:

• provide the argument--kms-key on the command line with a fullyspecified name;
• provide the argument--kms-keyring on the command line.

--kms-location=KMS_LOCATION

The Google Cloud location for the key.

To set thekms-location attribute:

• provide the argument--kms-key on the command line with a fullyspecified name;
• provide the argument--kms-location on the command line.

--kms-project=KMS_PROJECT

The Google Cloud project for the key.

To set thekms-project attribute:

• provide the argument--kms-key on the command line with a fullyspecified name;
• provide the argument--kms-project on the command line;
• set the propertycore/project.

Run$gcloud help for details.