Generally available: You can gradually create Flex-start VMs in a managed instance group (MIG) as capacity becomes available. Unlike resize requests for MIGs that wait for full capacity before creating VMs, this method might create only a portion of your requested Flex-start VMs if capacity is unavailable. The MIG creates the remaining VMs later as capacity permits. Flex-start VMs run for up to seven days and help you obtain high-demand resources, such as GPUs, at a discounted price.

For more information, see Create a MIG that uses Flex-start VMs.

Generally available: Compute Engine has enabled support of Spot VMs in Google Cloud Dedicated universes. Spot VMs are available for C3, M3, and A3 machine series. Use Spot VMs for workloads that can withstand preemption to receive a discount of up to 60% off the on-demand price. For the latest pricing information, see the pricing page.

For information about how Spot VMs work, see Spot VMs and Create and use Spot VMs.

Generally available: You can create a Hyperdisk Balanced High Availability disk by cloning a zonal Hyperdisk Balanced or Hyperdisk Extreme disk. This lets you make your zonal workloads highly available by adding a replica of the data in another zone within the same region.

For more information, see Create a regional disk clone from a zonal disk.

Generally available: You can rotate the customer-managed encryption key (CMEK) used to encrypt a disk, standard snapshot, or archive snapshot to a new key version without downtime.

Generally available: You can change the CMEK used to encrypt a disk, standard snapshot, or archive snapshot to a different key without downtime.

For more information, see Rotate the CMEK for a disk or standard snapshot and Change the CMEK for a disk or standard snapshot.

You can view the physical location of your Compute Engine instances in a zone to understand your cluster topology. This information helps you reduce network latency between your compute instances. For more information, see View Compute Engine instance topology.

Feature

Generally available: You can control the physical location of the Compute Engine instances in a MIG by using workload policies. Workload policies help you to, for example, place your compute instances close together to minimize network latency when running AI or ML workloads. For more information, see About workload policies in MIGs.

Preview: To control the use of the deprecated container startup agent, an option for deploying containers on Compute Engine instances, you can enforce the constraints/compute.managed.disableVmsWithContainerStartupAgent organization policy constraint. This constraint prevents the creation of Compute Engine instances that use the container startup agent and the gce-container-declaration metadata.

You can also enforce this organization policy in dry-run mode to identify projects that use the deprecated metadata, without blocking resource creation.

For more information, see Prevent the creation of VMs that use the container metadata and Migrate containers deployed on VMs during VM creation.

Generally available: The maximum throughput for a Hyperdisk Balanced High Availability disk is increased to 2,400 MiB/s from 1,200 MiB/s. Hyperdisk Balanced High Availability provides high availability block storage for mission-critical workloads by synchronously replicating data between two zones within a region.

For more information, see Hyperdisk Balanced High Availability overview.

Preview: The instance flexibility policy of a managed instance group (MIG) lets you override the minimum CPU platform and disk definition that is specified in the MIG's instance template. With these overrides, you can select machine types that run on different CPU platforms and that have different architectures.

For more information, see About instance flexibility in MIGs.

Changed: The following operations on the boot disk of a Compute Engine instance that has a service account attached require the iam.serviceAccounts.actAs permission on the service account. In the following list, the boot disk of such an instance is referred to as the source disk.

• Creating a standard or archive snapshot of the source disk, including application consistent snapshots
• Cloning the source disk
• Creating a machine image of the instance
• Creating a custom image of the source disk
• Starting asynchronous replication of the source disk to another region
• Creating a new disk when you create an instance, if the new disk is created from an instant snapshot of the source disk

If you already have the Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) role and the Service Account User (v1) (roles/iam.serviceAccountUser) role on the project, no action is required.

Otherwise, ask your administrator to grant you the iam.serviceAccounts.actAs permission on the service account. For instructions, see Manage access to other resources.

To address high-severity kernel vulnerabilities (including CVE-2025-21756 and CVE-2025-38052) in Rocky Linux 8 and 9, updates are available for the Compute Engine images maintained by CIQ. If your VM instances use images dated before September 2025 (version v20250912), you must take action to ensure you continue to receive security patches.

How to determine if your Compute Engine VMs are affected

You are affected if your VM instance uses a Rocky Linux image from an -optimized-gcp or -optimized-gcp-nvidia family with a version date older than v20250912 (for example, rocky-linux-9-optimized-gcp-v20250807). To check your VM's source image, see View VM instance image details. You can view details for these image families in Rocky Linux OS details.

Action required

• If your image version is v20250912 or later: Your VM is already configured to use the newer SIG/Cloud Next (SCN) repositories and is receiving security updates. No action is required.

• If your image version is older than v20250912: Your VM is configured to use legacy SIG/Cloud repositories that no longer receive regular kernel updates and won't receive future security patches. While running sudo dnf update applies a one-time patch for the vulnerabilities listed, you must manually migrate the VM to the SCN repositories to receive ongoing updates by following the CIQ migration guide.

Generally available: You can use managed constraints with Organization Policy Service for centralized, programmatic control of your Compute Engine resources. Managed constraints replace legacy compute.* constraints and are identifiable by the compute.managed.* prefix. They also include built-in support for safe rollout tools like Policy Simulator and dry run mode.

For more information, see Organization policies for Compute Engine and Managed constraints.

Generally available: You can apply compact placement policies to standalone Flex-start VMs. These policies let you colocate your standalone Flex-start VMs as close to each other as possible. Applying a compact placement policy minimizes network hops and improves the performance of latency-sensitive workloads. For more information, see About compact placement policies and About Flex-start VMs.

Generally available: You can use instance flexibility to improve resource availability when creating VMs in bulk in a region. With instance flexibility, you specify one or more suitable machine types for your workload. Compute Engine then provisions VMs from the list of machine types based on capacity and quota availability.

For more information, see About instance flexibility for VMs created in bulk and Create VMs in bulk with instance flexibility.

You can autoscale a managed instance group (MIG) that has instance flexibility configured. Autoscaling lets the MIG create or delete virtual machine instances based on an increase or decrease in load. For more information, see About instance flexibility.

When you autoscale a regional managed instance group (MIG), you can view the reasons why the autoscaler adds or removes VMs in your MIG. Autoscaling reasons were previously available only for zonal MIGs. For more information, see Viewing autoscaler logs.

Instance flexibility in regional managed instance groups (MIGs) support the ANY target distribution shape. Selecting this shape lets you maximize resource obtainability and the utilization of unused zonal reservations. For more information, see About instance flexibility in MIGs.

If you clone a source disk that's encrypted with a customer-supplied encryption key or customer-managed encryption key, you must use the same key to encrypt the clone.

For more information, see Create a clone of an encrypted source disk.

C4 machine type virtual machine (VM) instances running on sole tenant nodes might encounter unexpected VM terminations due to host errors or VM creation failures. For more information, see known issues.

Public Preview: You can now access the VM metadata server using IPv6 connectivity from single-stack IPv6 VM instances. For more information, see About VM metadata.

You can autoscale a regional managed instance group (MIG) that has the target distribution shape set to ANY or ANY_SINGLE_ZONE. These shapes are particularly beneficial for batch workloads. For more information about target distribution shapes, see Regional MIG target distribution shape.

Preview: Future reservation requests in calendar mode support reserving capacity for a3-megagpu-8g and a3-highgpu-8g machine types. Use future reservation requests in calendar mode to obtain resources for running model pre-training, model fine-tuning, simulation, and inference workloads. For more information, see About future reservation requests in calendar mode.

The Windows guest agent identifies administrator accounts and groups using string matching. Therefore, credential management features only function correctly when you use English language names for user accounts and groups, for example, Administrators. If you use non-English language names, credential management features such as generating or resetting passwords might not function as expected. For more information about managing Windows user accounts, see Manage accounts and credentials on Windows VMs and Known issues for Windows VM instances.

Generally available: You can verify which reservation a VM consumes and view a list of VMs that consume a reservation. For more information, see View reservation consumption.

If you need to synchronize time with high accuracy and monitor its accuracy for your Compute Engine instances, you can sync your VM clock with its host server clock using chrony and ptp_kvm. This configuration provides accuracy within 1 ms for supported setups. For more information, see Configure accurate time for Compute Engine VMs.

Generally available: Dynamic NICs let you add or remove network interfaces to or from an instance without restarting or recreating the instance.

You can also use Dynamic NICs when you need more network interfaces. The maximum number of vNICs for most machine types in Google Cloud is 10; however, you can configure up to 16 total interfaces by using Dynamic NICs.

For more information, see the following:

• Multiple network interfaces overview
• Create VM instances with multiple network interfaces
• Add Dynamic NICs to an instance

Generally available: Future reservations let you reserve capacity for a specific date up to one year in advance. For more information, see About future reservation requests.

Change

As part of the consolidation of CIQ's kernel trees, the kernel dist-tag that supports the Rocky Linux Optimized and Accelerator images on Compute Engine is changing from elX_ycld_next to elX_y_ciq. There are no changes to Secure Boot or GPG signing keys.

For example, 6.12.0-55.32.1.el10_0cld_next.2.1 changes to 6.12.0-55.39.1.el10_0_ciq.2.1, where ciq replaces the cld_next tag.

This change affects the Rocky Linux 8, 9, and 10 optimized and accelerator images in an upcoming kernel update over the next month. The major version 8 and 9 kernels now include FIPS 140-3 patches as part of CIQ's ongoing FIPS 140-3 validation efforts for Rocky Linux. These patches have no effect if FIPS mode is not enabled. There are no code changes to the major version 10 kernel.

You can find the kernel source tree in the CIQ kernel-src-tree GitHub repository.

Generally Available: The G4 accelerator-optimized machine series is designed for graphics-intensive workloads such as NVIDIA Omniverse simulations, video transcoding, and virtual desktops. The G4 machine series also provides a cost-effective solution for single-host inference and model tuning. The G4 machine series is now available in the following regions and zones:

• APAC
  • Jurong West, Singapore: asia-southeast1-b
• Europe
  • Eemshaven, Netherlands: europe-west4-a
• North America
  • Council Bluffs, Iowa: us-central1-b
  • Ashburn, Virginia: us-east4-c
  • Columbus, Ohio: us-east5-c

To get started with G4 machine types, see Create a G2 or G4 instance.

Generally Available: You can use the Compute Engine alpha API at the project level through a self-service process. By enabling the alpha API, you can use the Google Cloud console, Google Cloud CLI, API, and Terraform to view and manage preview features. For more information, see Use the Compute Engine alpha API.

Generally Available: You can use the Compute Engine alpha API at the project level through a self-service process. By enabling the alpha API, you can use the Google Cloud console, Google Cloud CLI, API, and Terraform to view and manage preview features. For more information, see Use the Compute Engine alpha API.

Starting with SUSE Linux Enterprise Server (SLES) 16, including variants for SAP, the default file system for the root partition (/) is Btrfs, which replaces the previous default of XFS. For more information, see File systems in SLES in the SUSE documentation.