Generally available: A3 High machine types with 1, 2, 4, or 8 NVIDIA H100 GPUs attached. These machine types are ideal for high performance computing (HPC) and machine learning (ML) workloads such as model inference, model training and fine tuning, and simulations.
To get started, see the Accelerator-optimized machine family guide.
]]>Changed: The following operations on the boot disk of a Compute Engine instance
that has a service account attached no longer require the iam.serviceAccounts.actAs
permission. In the following list, the boot disk of such an instance is
referred to as the source disk.
Preview: Advanced Compute Images are available in Google Cloud Dedicated. These images provide high-performance images to support your artificial intelligence (AI), machine learning (ML), and high-performance computing (HPC) workloads on Google Cloud.
Advanced Compute Images provide a single source of trusted, performance-tuned OS images that remove the need for manual image building for specialized workloads. Each image version is pre-installed with the necessary drivers, network fabrics, and Slurm agents to help you run your workloads.
For more information, see Overview of Advanced Compute Images.
]]>Generally available: Compute flexible committed use discounts (CUDs) are available in Google Cloud Dedicated. Compute flexible commitments are spend-based commitments that you can purchase to cover eligible spend across Compute Engine, Google Kubernetes Engine, and Cloud Run.
To purchase spend-based commitments, contact Billing support. For more information, see Billing differences in Google Cloud Dedicated.
]]>Generally available: In a managed instance group (MIG), you can use a health check to monitor your application health without triggering repairs for an unhealthy VM, if the application fails the health check. You can prevent the MIG from repairing an unhealthy VM by turning off autohealing. For more information, see Turn off repairs in a MIG.
]]>Generally available: You can create instances all at once in a regional managed instance group (MIG) by using resize requests. For more information, see About resize requests in a MIG.
]]>Generally available: Compute Engine has enabled support of Spot VMs in Google Cloud Dedicated universes. Spot VMs are available for C3, M3, and A3 machine series. Use Spot VMs for workloads that can withstand preemption to receive a discount of up to 60% off the on-demand price. For the latest pricing information, see the pricing page.
For information about how Spot VMs work, see Spot VMs and Create and use Spot VMs.
]]>Generally available: You can rotate the customer-managed encryption key (CMEK) used to encrypt a disk, standard snapshot, or archive snapshot to a new key version without downtime.
Generally available: You can change the CMEK used to encrypt a disk, standard snapshot, or archive snapshot to a different key without downtime.
For more information, see Rotate the CMEK for a disk or standard snapshot and Change the CMEK for a disk or standard snapshot.
]]>You can view the physical location of your Compute Engine instances in a zone to understand your cluster topology. This information helps you reduce network latency between your compute instances. For more information, see View Compute Engine instance topology.
Generally available: You can control the physical location of the Compute Engine instances in a MIG by using workload policies. Workload policies help you to, for example, place your compute instances close together to minimize network latency when running AI or ML workloads. For more information, see About workload policies in MIGs.
]]>Preview: To control the use of the deprecated container startup agent, an option for
deploying containers on Compute Engine instances, you can enforce the
constraints/compute.managed.disableVmsWithContainerStartupAgent organization
policy constraint. This constraint prevents the creation of
Compute Engine instances that use the container startup
agent and the gce-container-declaration metadata.
You can also enforce this organization policy in dry-run mode to identify projects that use the deprecated metadata, without blocking resource creation.
For more information, see Prevent the creation of VMs that use the container metadata and Migrate containers deployed on VMs during VM creation.
]]>Preview: The instance flexibility policy of a managed instance group (MIG) lets you override the minimum CPU platform and disk definition that is specified in the MIG's instance template. With these overrides, you can select machine types that run on different CPU platforms and that have different architectures.
For more information, see About instance flexibility in MIGs.
]]>Changed: The following operations on the boot disk of a Compute Engine instance
that has a service account attached require the iam.serviceAccounts.actAs permission
on the service account. In the following list, the boot disk of such an instance is
referred to as the source disk.
If you already have the Compute Instance Admin (v1)
(roles/compute.instanceAdmin.v1) role and the Service Account User (v1)
(roles/iam.serviceAccountUser) role on the project, no action is required.
Otherwise, ask your administrator to grant you the iam.serviceAccounts.actAs
permission on the service account. For instructions, see
Manage access to other resources.
To address high-severity kernel vulnerabilities (including CVE-2025-21756 and CVE-2025-38052) in Rocky Linux 8 and 9, updates are available for the Compute Engine images maintained by CIQ. If your VM instances use images dated before September 2025 (version v20250912), you must take action to ensure you continue to receive security patches.
How to determine if your Compute Engine VMs are affected
You are affected if your VM instance uses a Rocky Linux image from an -optimized-gcp or -optimized-gcp-nvidia family with a version date older than v20250912 (for example, rocky-linux-9-optimized-gcp-v20250807). To check your VM's source image, see View VM instance image details. You can view details for these image families in Rocky Linux OS details.
Action required
If your image version is v20250912 or later: Your VM is already configured to use the newer SIG/Cloud Next (SCN) repositories and is receiving security updates. No action is required.
If your image version is older than v20250912: Your VM is configured to use legacy SIG/Cloud repositories that no longer receive regular kernel updates and won't receive future security patches. While running sudo dnf update applies a one-time patch for the vulnerabilities listed, you must manually migrate the VM to the SCN repositories to receive ongoing updates by following the CIQ migration guide.
Generally available: You can use managed constraints with Organization Policy Service
for centralized, programmatic control of your Compute Engine resources.
Managed constraints replace legacy compute.* constraints and are identifiable
by the compute.managed.* prefix. They also include built-in support for safe
rollout tools like Policy Simulator and dry run mode.
For more information, see Organization policies for Compute Engine and Managed constraints.
]]>Generally available: You can use instance flexibility to improve resource availability when creating VMs in bulk in a region. With instance flexibility, you specify one or more suitable machine types for your workload. Compute Engine then provisions VMs from the list of machine types based on capacity and quota availability.
For more information, see About instance flexibility for VMs created in bulk and Create VMs in bulk with instance flexibility.
]]>You can autoscale a managed instance group (MIG) that has instance flexibility configured. Autoscaling lets the MIG create or delete virtual machine instances based on an increase or decrease in load. For more information, see About instance flexibility.
]]>When you autoscale a regional managed instance group (MIG), you can view the reasons why the autoscaler adds or removes VMs in your MIG. Autoscaling reasons were previously available only for zonal MIGs. For more information, see Viewing autoscaler logs.
]]>Instance flexibility in regional managed instance
groups (MIGs) support the ANY target distribution shape. Selecting this shape
lets you maximize resource obtainability and the utilization of unused zonal
reservations. For more information, see
About instance flexibility in MIGs.
If you clone a source disk that's encrypted with a customer-supplied encryption key or customer-managed encryption key, you must use the same key to encrypt the clone.
For more information, see Create a clone of an encrypted source disk.
]]>Public Preview: You can now access the VM metadata server using IPv6 connectivity from single-stack IPv6 VM instances. For more information, see About VM metadata.
]]>You can autoscale a regional managed instance group
(MIG) that has the target distribution shape set to ANY or ANY_SINGLE_ZONE.
These shapes are particularly beneficial for batch workloads.
For more information about target distribution shapes, see
Regional MIG target distribution shape.
The Windows guest agent identifies administrator accounts and groups using
string matching. Therefore, credential management features only function
correctly when you use English language names for user accounts and groups,
for example, Administrators. If you use non-English language names, credential
management features such as generating or resetting passwords might not function
as expected. For more information about managing Windows user accounts, see
Manage accounts and credentials on Windows VMs and
Known issues for Windows VM instances.
Generally available: You can verify which reservation a VM consumes and view a list of VMs that consume a reservation. For more information, see View reservation consumption.
]]>If you need to synchronize time with high accuracy and monitor its accuracy for
your Compute Engine instances, you can sync your VM clock with its host
server clock using chrony and ptp_kvm. This configuration provides accuracy
within 1 ms for supported setups. For more information, see
Configure accurate time for Compute Engine VMs.
Generally available: Dynamic NICs let you add or remove network interfaces to or from an instance without restarting or recreating the instance.
You can also use Dynamic NICs when you need more network interfaces. The maximum number of vNICs for most machine types in Google Cloud is 10; however, you can configure up to 16 total interfaces by using Dynamic NICs.
For more information, see the following:
]]>Generally available: Future reservations let you reserve capacity for a specific date up to one year in advance. For more information, see About future reservation requests.
As part of the consolidation of CIQ's kernel trees, the kernel dist-tag that supports the Rocky Linux Optimized and Accelerator images on Compute Engine is changing from elX_ycld_next to elX_y_ciq. There are no changes to Secure Boot or GPG signing keys.
For example, 6.12.0-55.32.1.el10_0cld_next.2.1 changes to 6.12.0-55.39.1.el10_0_ciq.2.1, where ciq replaces the cld_next tag.
This change affects the Rocky Linux 8, 9, and 10 optimized and accelerator images in an upcoming kernel update over the next month. The major version 8 and 9 kernels now include FIPS 140-3 patches as part of CIQ's ongoing FIPS 140-3 validation efforts for Rocky Linux. These patches have no effect if FIPS mode is not enabled. There are no code changes to the major version 10 kernel.
You can find the kernel source tree in the CIQ kernel-src-tree GitHub repository.
]]>Generally Available: The G4 accelerator-optimized machine series is designed for graphics-intensive workloads such as NVIDIA Omniverse simulations, video transcoding, and virtual desktops. The G4 machine series also provides a cost-effective solution for single-host inference and model tuning. The G4 machine series is now available in the following regions and zones:
asia-southeast1-beurope-west4-aus-central1-bus-east4-cus-east5-cTo get started with G4 machine types, see Create a G2 or G4 instance.
]]>Generally Available: You can use the Compute Engine alpha API at the project level through a self-service process. By enabling the alpha API, you can use the Google Cloud console, Google Cloud CLI, API, and Terraform to view and manage preview features. For more information, see Use the Compute Engine alpha API.
]]>Generally Available: You can use the Compute Engine alpha API at the project level through a self-service process. By enabling the alpha API, you can use the Google Cloud console, Google Cloud CLI, API, and Terraform to view and manage preview features. For more information, see Use the Compute Engine alpha API.
]]>Starting with SUSE Linux Enterprise Server (SLES) 16, including variants for SAP, the default file system for the root partition (/) is Btrfs, which replaces the previous default of XFS. For more information, see File systems in SLES in the SUSE documentation.