Container-Optimized OS from Google is an operating system image for Compute Engine VMs tailored specifically to running containers. It is maintained by Google, based on the open source Chromium OS project, and deliberately ships with less functionality than a full Linux image.
What is Container-Optimized OS?
Container-Optimized OS is designed to bring up containers on Google Cloud quickly, efficiently, and securely. Instances come pre-installed with the Docker and containerd runtimes and cloud-init, so a container can start at the same time the VM is created, with no on-host setup required.
The security approach is based on reduction: the smaller footprint reduces an instance’s potential attack surface, and instances include a locked-down firewall and other security settings by default. Updates are downloaded automatically in the background every week; only a reboot is needed to activate them.
This reduction comes with deliberate limitations. There is no package manager, so software cannot be installed directly on the instance - the CoreOS toolbox provides debugging and administration tools in an isolated container. Execution of non-containerized applications is not supported, the kernel is locked down and does not allow third-party modules or drivers, and use outside Google Cloud is not supported.
In Google Kubernetes Engine, Container-Optimized OS is the default node image according to the documentation; beyond that it can be used directly for Compute Engine instances that should run a container with minimal setup. No separate license fee for the image is documented; you pay for the Compute Engine resources used.
Core Features
- Containers out of the box: Docker and containerd runtimes and cloud-init are pre-installed.
- Small footprint: The reduced scope lowers the potential attack surface.
- Secure defaults: Instances start with a locked-down firewall and other security settings.
- Automatic updates: Weekly updates download in the background and activate with a reboot.
- Default in GKE: Used as the default node OS image in Google Kubernetes Engine.
- CoreOS toolbox: Debugging and administration tools run isolated in a container.
Typical Use Cases
Running a single container on a VM
For a small service, a Compute Engine instance with Container-Optimized OS is created that already runs the container at startup, without configuring the host.
Nodes for Kubernetes clusters
GKE clusters use Container-Optimized OS as their default node image and benefit from the automatic updates.
Hardening container hosts
A security team standardizes container hosts on Container-Optimized OS to rule out package installations and kernel modules on the hosts.
Operating without your own OS patching
Instead of maintaining patch processes for Linux images, an operations team relies on the image’s automatic weekly updates.
Short-lived build or job runners
Ephemeral instances for build or batch jobs start with Container-Optimized OS because the image runs containers without further preparation.
Benefits
- Ready to use: Containers start without host setup.
- Reduced attack surface: Fewer installed components mean fewer potential vulnerabilities.
- Less patching effort: Automatic weekly updates instead of your own OS maintenance.
- Consistent with GKE: The same image GKE uses by default as its node operating system.
- No separate license cost documented: Costs arise through the Compute Engine resources used.
Integration with innFactory
As a certified Google Cloud Partner, innFactory supports you in using Container-Optimized OS: selecting suitable node images for GKE, hardening container hosts, working within the image’s limitations, and establishing operational and update processes.
Contact us for a consultation on Container-Optimized OS and Google Cloud.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Container-Optimized OS?
According to the documentation, Container-Optimized OS from Google is an operating system image for your Compute Engine VMs that is optimized for running containers. It is maintained by Google and based on the open source Chromium OS project.
What benefits does Google list?
The documentation names four points: containers run out of the box because Docker and containerd runtimes and cloud-init are pre-installed; the smaller footprint reduces the instance's potential attack surface; instances ship with a locked-down firewall and other security settings by default; and updates are downloaded automatically in the background every week.
What are the limitations?
Container-Optimized OS does not include a package manager, so software cannot be installed directly on an instance; the CoreOS toolbox provides debugging and admin tools in an isolated container. Execution of non-containerized applications is not supported, the kernel is locked down and does not allow third-party kernel modules or drivers, and the OS is not supported outside the Google Cloud environment.
Is Container-Optimized OS used in GKE?
Yes. According to the documentation, Container-Optimized OS is the default node OS image in Kubernetes Engine and other Kubernetes deployments on Google Cloud.
What does Container-Optimized OS cost?
The documentation does not state a separate license fee for the image. Because it runs on Compute Engine VMs, costs arise for the Compute Engine resources used. Current prices are published on the Compute Engine pricing page.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
