Use a shielded virtual machine with user-managed notebooks

Vertex AI Workbench user-managed notebooks isdeprecated. On April 14, 2025, support for user-managed notebooks ended and the ability to create user-managed notebooks instances was removed. Existing instances will continue to function until March 30, 2026, but patches, updates, and upgrades won't be available. To continue using Vertex AI Workbench, we recommend that youmigrate your user-managed notebooks instances to Vertex AI Workbench instances.

So you can be confident that your instances have not been compromised byboot- or kernel-level malware or rootkits,Shielded VM offers verifiable integrity of Compute Engine VMinstances.Shielded VM's verifiable integrity is achieved through theuse ofSecure Boot,virtual trusted platform module(vTPM)-enabledMeasuredBoot, andintegritymonitoring.

For more information, seeShielded VM.

Requirements and limitations

To use Shielded VM with user-managed notebooks,you must createa Deep Learning VM Images with a Debian 10 OS thatisversionM51or higher.

While using Vertex AI Workbench, you can't useshielded VM user-managed notebooks instancesthat use GPU accelerators.

Create a user-managed notebooks instance using a shielded VM

To create a shielded VM that you can use withuser-managed notebooks, complete the following steps:

1. Select the image family that you want your instance to be basedon. Use the followingGoogle Cloud CLI command tolist the available image families that are compatiblewith user-managed notebooksand Shielded VM. You can run the command inCloud Shellor any environment where theGoogle Cloud CLIis installed.

   gcloudcomputeimageslist\--projectdeeplearning-platform-release\--no-standard-images|grepdebian-10

2. Use the following command to create the Compute Engine instance.

   gcloudcomputeinstancescreatenb-legacy2\--image-project=deeplearning-platform-release\--image-family=MY_IMAGE_FAMILY\--metadata="proxy-mode=service_account"\--scopes=https://www.googleapis.com/auth/cloud-platform\--shielded-secure-boot\--zone=MY_ZONE

   Replace the following:

   • MY_IMAGE_FAMILY: the image family name that youwant to use to create your VM
   • MY_ZONE: the zone where you want your instanceto be located

3. Register your Compute Engine VM with theNotebooks API.

What's next

• Learn more aboutuser-managed notebooks imagefamilies.

• Learn more aboutmodifying Shielded VMoptions.