.TH "GCLOUD_BETA_COMPUTE_IMAGES_CREATE" 1



.SH "NAME"
.HP
gcloud beta compute images create \- create Compute Engine images



.SH "SYNOPSIS"
.HP
\f5gcloud beta compute images create\fR \fIIMAGE_NAME\fR (\fB\-\-source\-disk\fR=\fISOURCE_DISK\fR\ |\ \fB\-\-source\-image\fR=\fISOURCE_IMAGE\fR\ |\ \fB\-\-source\-image\-family\fR=\fISOURCE_IMAGE_FAMILY\fR\ |\ \fB\-\-source\-snapshot\fR=\fISOURCE_SNAPSHOT\fR\ |\ \fB\-\-source\-uri\fR=\fISOURCE_URI\fR) [\fB\-\-architecture\fR=\fIARCHITECTURE\fR] [\fB\-\-csek\-key\-file\fR=\fIFILE\fR] [\fB\-\-description\fR=\fIDESCRIPTION\fR] [\fB\-\-family\fR=\fIFAMILY\fR] [\fB\-\-forbidden\-database\-file\fR=[\fIDBX_VALUE\fR,...]] [\fB\-\-force\fR] [\fB\-\-force\-create\fR] [\fB\-\-guest\-os\-features\fR=[\fIGUEST_OS_FEATURE\fR,...]] [\fB\-\-key\-exchange\-key\-file\fR=[\fIKEK_VALUE\fR,...]] [\fB\-\-labels\fR=[\fIKEY\fR=\fIVALUE\fR,...]] [\fB\-\-licenses\fR=[\fILICENSES\fR,...]] [\fB\-\-platform\-key\-file\fR=\fIPLATFORM_KEY_FILE\fR] [\fB\-\-no\-require\-csek\-key\-create\fR] [\fB\-\-signature\-database\-file\fR=[\fIDB_VALUE\fR,...]] [\fB\-\-source\-disk\-project\fR=\fISOURCE_DISK_PROJECT\fR] [\fB\-\-source\-disk\-zone\fR=\fISOURCE_DISK_ZONE\fR] [\fB\-\-source\-image\-project\fR=\fISOURCE_IMAGE_PROJECT\fR] [\fB\-\-storage\-location\fR=\fILOCATION\fR] [\fB\-\-user\-licenses\fR=[\fILICENSE\fR,...]] [\fB\-\-kms\-key\fR=\fIKMS_KEY\fR\ :\ \fB\-\-kms\-keyring\fR=\fIKMS_KEYRING\fR\ \fB\-\-kms\-location\fR=\fIKMS_LOCATION\fR\ \fB\-\-kms\-project\fR=\fIKMS_PROJECT\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(BETA)\fR \fBgcloud beta compute images create\fR is used to create custom
disk images. The resulting image can be provided during instance or disk
creation so that the instance attached to the resulting disks has access to a
known set of software or files from the image.

Images can be created from gzipped compressed tarball containing raw disk data,
existing disks in any zone, existing images, and existing snapshots inside the
same project.

Images are global resources, so they can be used across zones and projects.

To learn more about creating image tarballs, visit
https://cloud.google.com/compute/docs/creating\-custom\-image.



.SH "EXAMPLES"

To create an image 'my\-image' from a disk 'my\-disk' in zone 'us\-east1\-a',
run:

.RS 2m
$ gcloud beta compute images create my\-image \-\-source\-disk=my\-disk \e
  \-\-source\-disk\-zone=us\-east1\-a
.RE

To create an image 'my\-image' from a disk 'my\-disk' in zone 'us\-east1\-a'
with source disk project 'source\-disk\-project' run:

.RS 2m
$ gcloud beta compute images create my\-image \-\-source\-disk=my\-disk \e
  \-\-source\-disk\-zone=us\-east1\-a \e
  \-\-source\-disk\-project=source\-disk\-project
.RE

To create an image 'my\-image' from another image 'source\-image' with source
image project 'source\-image\-project', run:

.RS 2m
$ gcloud beta compute images create my\-image \e
  \-\-source\-image=source\-image \e
  \-\-source\-image\-project=source\-image\-project
.RE

To create an image 'my\-image' from the latest non\-deprecated image in the
family 'source\-image\-family' with source image project
\'source\-image\-project', run:

.RS 2m
$ gcloud beta compute images create my\-image \e
  \-\-source\-image\-family=source\-image\-family \e
  \-\-source\-image\-project=source\-image\-project
.RE

To create an image 'my\-image' from a snapshot 'source\-snapshot', run:

.RS 2m
$ gcloud beta compute images create my\-image \e
  \-\-source\-snapshot=source\-snapshot
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m
\fIIMAGE_NAME\fR

Name of the disk image to create.


.RE
.sp

.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m

Exactly one of these must be specified:


.RS 2m
.TP 2m
\fB\-\-source\-disk\fR=\fISOURCE_DISK\fR

A source disk to create the image from. The value for this option can be the
name of a disk with the zone specified via \f5\fI\-\-source\-disk\-zone\fR\fR
flag.

.TP 2m
\fB\-\-source\-image\fR=\fISOURCE_IMAGE\fR

The name of an image to clone. May be used with
\f5\fI\-\-source\-image\-project\fR\fR to clone an image in a different project.

.TP 2m
\fB\-\-source\-image\-family\fR=\fISOURCE_IMAGE_FAMILY\fR

The family of the source image. This will cause the latest non\- deprecated
image in the family to be used as the source image. May be used with
\f5\fI\-\-source\-image\-project\fR\fR to refer to an image family in a
different project.

.TP 2m
\fB\-\-source\-snapshot\fR=\fISOURCE_SNAPSHOT\fR

A source snapshot to create the image from. The value for this option can be the
name of a snapshot within the same project as the destination image.

.TP 2m
\fB\-\-source\-uri\fR=\fISOURCE_URI\fR

The full Cloud Storage URI where the disk image is stored. This file must be a
gzip\-compressed tarball whose name ends in \f5\fI.tar.gz\fR\fR. For more
information about Cloud Storage URIs, see
https://cloud.google.com/storage/docs/request\-endpoints#json\-api.


.RE
.RE
.sp

.SH "OPTIONAL FLAGS"

.RS 2m
.TP 2m
\fB\-\-architecture\fR=\fIARCHITECTURE\fR

Specifies the architecture or processor type that this image can support. For
available processor types on Compute Engine, see
https://cloud.google.com/compute/docs/cpu\-platforms. \fIARCHITECTURE\fR must be
one of: \fBARM64\fR, \fBX86_64\fR.

.TP 2m
\fB\-\-csek\-key\-file\fR=\fIFILE\fR

Path to a Customer\-Supplied Encryption Key (CSEK) key file that maps Compute
Engine images to user managed keys to be used when creating, mounting, or taking
snapshots of disks.

If you pass \f5\-\fR as value of the flag, the CSEK is read from stdin. See
https://cloud.google.com/compute/docs/disks/customer\-supplied\-encryption for
more details.

.TP 2m
\fB\-\-description\fR=\fIDESCRIPTION\fR

An optional, textual description for the image being created.

.TP 2m
\fB\-\-family\fR=\fIFAMILY\fR

The family of the image. When creating an instance or disk, specifying a family
will cause the latest non\-deprecated image in the family to be used.

.TP 2m
\fB\-\-forbidden\-database\-file\fR=[\fIDBX_VALUE\fR,...]

Comma\-separated list of file paths that point to revoked X.509 certificates in
DER format or raw binary files. When you create a Shielded VM instance from this
image, these certificates or files are added to the forbidden signature database
(dbx).

.TP 2m
\fB\-\-force\fR

By default, image creation fails when it is created from a disk that is attached
to a running instance. When this flag is used, image creation from disk will
proceed even if the disk is in use.

.TP 2m
\fB\-\-force\-create\fR

(DEPRECATED) DEPRECATED, use \-\-force instead. By default, image creation fails
when it is created from a disk that is attached to a running instance. When this
flag is used, image creation from disk will proceed even if the disk is in use.

Flag force\-create is deprecated. Use \-\-force instead.

.TP 2m
\fB\-\-guest\-os\-features\fR=[\fIGUEST_OS_FEATURE\fR,...]

Enables one or more features for VM instances that use the image for their boot
disks. See the descriptions of supported features at:
https://cloud.google.com/compute/docs/images/create\-delete\-deprecate\-private\-images#guest\-os\-features.
\fIGUEST_OS_FEATURE\fR must be one of: \fBBARE_METAL_LINUX_COMPATIBLE\fR,
\fBGVNIC\fR, \fBIDPF\fR, \fBMULTI_IP_SUBNET\fR, \fBSEV_CAPABLE\fR,
\fBSEV_LIVE_MIGRATABLE\fR, \fBSEV_LIVE_MIGRATABLE_V2\fR, \fBSEV_SNP_CAPABLE\fR,
\fBSNP_SVSM_CAPABLE\fR, \fBTDX_CAPABLE\fR, \fBUEFI_COMPATIBLE\fR,
\fBVIRTIO_SCSI_MULTIQUEUE\fR, \fBWINDOWS\fR.

.TP 2m
\fB\-\-key\-exchange\-key\-file\fR=[\fIKEK_VALUE\fR,...]

Comma\-separated list of file paths that point to X.509 certificates in DER
format or raw binary files. When you create a Shielded VM instance from this
image, these certificates or files are used as key exchange keys (KEK).

.TP 2m
\fB\-\-labels\fR=[\fIKEY\fR=\fIVALUE\fR,...]

List of label KEY=VALUE pairs to add.

Keys must start with a lowercase character and contain only hyphens (\f5\-\fR),
underscores (\f5_\fR), lowercase characters, and numbers. Values must contain
only hyphens (\f5\-\fR), underscores (\f5_\fR), lowercase characters, and
numbers.

.TP 2m
\fB\-\-licenses\fR=[\fILICENSES\fR,...]

Comma\-separated list of URIs to license resources.

.TP 2m
\fB\-\-platform\-key\-file\fR=\fIPLATFORM_KEY_FILE\fR

File path that points to an X.509 certificate in DER format or raw binary file.
When you create a Shielded VM instance from this image, this certificate or raw
binary file is used as the platform key (PK).

.TP 2m
\fB\-\-require\-csek\-key\-create\fR

Refuse to create images not protected by a user managed key in the key file when
\-\-csek\-key\-file is given. This behavior is enabled by default to prevent
incorrect gcloud invocations from accidentally creating images with no user
managed key. Disabling the check allows creation of some images without a
matching Customer\-Supplied Encryption Key in the supplied \-\-csek\-key\-file.
See https://cloud.google.com/compute/docs/disks/customer\-supplied\-encryption
for more details. Enabled by default, use
\fB\-\-no\-require\-csek\-key\-create\fR to disable.

.TP 2m
\fB\-\-signature\-database\-file\fR=[\fIDB_VALUE\fR,...]

Comma\-separated list of file paths that point to valid X.509 certificates in
DER format or raw binary files. When you create a Shielded VM instance from this
image, these certificates or files are added to the signature database (db).

.TP 2m
\fB\-\-source\-disk\-project\fR=\fISOURCE_DISK_PROJECT\fR

Project name of the source disk. Must also specify \-\-source\-disk when using
this flag.

.TP 2m
\fB\-\-source\-disk\-zone\fR=\fISOURCE_DISK_ZONE\fR

Zone of the source disk to operate on. If not specified and the
\f5\fIcompute/zone\fR\fR property isn't set, you might be prompted to select a
zone (interactive mode only).

To avoid prompting when this flag is omitted, you can set the
\f5\fIcompute/zone\fR\fR property:

.RS 2m
$ gcloud config set compute/zone ZONE
.RE

A list of zones can be fetched by running:

.RS 2m
$ gcloud compute zones list
.RE

To unset the property, run:

.RS 2m
$ gcloud config unset compute/zone
.RE

Alternatively, the zone can be stored in the environment variable
\f5\fICLOUDSDK_COMPUTE_ZONE\fR\fR.

.TP 2m
\fB\-\-source\-image\-project\fR=\fISOURCE_IMAGE_PROJECT\fR

The project name of the source image. Must also specify either
\f5\fI\-\-source\-image\fR\fR or \f5\fI\-\-source\-image\-family\fR\fR when
using this flag.

.TP 2m
\fB\-\-storage\-location\fR=\fILOCATION\fR

Specifies a Cloud Storage location, either regional or multi\-regional, where
image content is to be stored. If not specified, the multi\-region location
closest to the source is chosen automatically.

.TP 2m
\fB\-\-user\-licenses\fR=[\fILICENSE\fR,...]

URI for the license resource. For multiple licenses, you can provide a
comma\-separated list of URIs.

.TP 2m

Key resource \- The Cloud KMS (Key Management Service) cryptokey that will be
used to protect the image. The 'Compute Engine Service Agent' service account
must hold permission 'Cloud KMS CryptoKey Encrypter/Decrypter'. The arguments in
this group can be used to specify the attributes of this resource.


.RS 2m
.TP 2m
\fB\-\-kms\-key\fR=\fIKMS_KEY\fR

ID of the key or fully qualified identifier for the key.

To set the \f5kms\-key\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-key\fR on the command line.
.RE
.sp

This flag argument must be specified if any of the other arguments in this group
are specified.

.TP 2m
\fB\-\-kms\-keyring\fR=\fIKMS_KEYRING\fR

The KMS keyring of the key.

To set the \f5kms\-keyring\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-key\fR on the command line with a fully
specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-keyring\fR on the command line.
.RE
.sp

.TP 2m
\fB\-\-kms\-location\fR=\fIKMS_LOCATION\fR

The Google Cloud location for the key.

To set the \f5kms\-location\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-key\fR on the command line with a fully
specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-location\fR on the command line.
.RE
.sp

.TP 2m
\fB\-\-kms\-project\fR=\fIKMS_PROJECT\fR

The Google Cloud project for the key.

To set the \f5kms\-project\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-key\fR on the command line with a fully
specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-kms\-project\fR on the command line;
.IP "\(bu" 2m
set the property \f5core/project\fR.
.RE
.sp


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

This command is currently in beta and might change without notice. These
variants are also available:

.RS 2m
$ gcloud compute images create
.RE

.RS 2m
$ gcloud alpha compute images create
.RE