From db74a4fedcefbd55e5e217f0d8fd020002180a56 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:34:05 -0600
Subject: [PATCH 01/21] Create main.tf

---
 container-vm/main.tf | 59 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 container-vm/main.tf

diff --git a/container-vm/main.tf b/container-vm/main.tf
new file mode 100644
index 0000000..bd4787b
--- /dev/null
+++ b/container-vm/main.tf
@@ -0,0 +1,59 @@
+# Fetch the latest source image based on the input variables (defaulting to COS)
+data "google_compute_image" "source_image" {
+  family  = var.source_image_family
+  project = var.source_image_project
+}
+
+# Render the cloud-init YAML template using dynamic module inputs
+locals {
+  rendered_cloud_init = templatefile("${path.module}/cloud-init.yaml.tftpl", {
+    container_name    = var.container_name,
+    container_image   = var.container_image,
+    restart_policy    = var.restart_policy,
+    container_env     = var.container_env,
+    container_command = var.container_command,
+    container_args    = var.container_args,
+  })
+}
+
+# The Instance Template resource itself
+resource "google_compute_instance_template" "container_vm_template" {
+  project      = var.project_id
+  name_prefix  = "systemd-container-tmpl-"
+  description  = "Runs a container using Docker, managed by a systemd unit via cloud-init."
+  machine_type = var.machine_type
+  region       = var.region
+  
+  # Disk configuration using the fetched OS image
+  disk {
+    source_image = data.google_compute_image.source_image.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  # Network configuration
+  network_interface {
+    network    = "default" 
+    subnetwork = null      
+    
+    # Assign an external IP address (access_config is required for external IP)
+    access_config {}
+  }
+
+  # Service Account configuration (needed for Google Cloud API access, including image pulls)
+  service_account {
+    email  = "default" # Use the project's default compute service account
+    scopes = ["cloud-platform"]
+  }
+
+  # Critical step: inject the cloud-init script via the 'user-data' metadata key.
+  metadata = {
+    user-data = local.rendered_cloud_init
+  }
+
+  scheduling {
+    automatic_restart   = true
+    on_host_maintenance = "MIGRATE"
+  }
+}
+

From b0b77bc7fad14481d96c55e4cc6655b3a3b820a7 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:34:58 -0600
Subject: [PATCH 02/21] Create variables.tf

---
 container-vm/variables.tf | 65 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 container-vm/variables.tf

diff --git a/container-vm/variables.tf b/container-vm/variables.tf
new file mode 100644
index 0000000..62a0d95
--- /dev/null
+++ b/container-vm/variables.tf
@@ -0,0 +1,65 @@
+variable "project_id" {
+  description = "The GCP project ID."
+  type        = string
+}
+
+variable "region" {
+  description = "The region where the compute template is created."
+  type        = string
+  default     = "us-central1"
+}
+
+variable "machine_type" {
+  description = "The machine type for the VM instance template."
+  type        = string
+  default     = "e2-medium"
+}
+
+variable "container_image" {
+  description = "The container image to run (e.g., 'nginx:latest' or 'gcr.io/my-project/my-app:v1')."
+  type        = string
+}
+
+variable "container_name" {
+  description = "The name to assign to the running Docker container."
+  type        = string
+  default     = "gce-container-app"
+}
+
+variable "restart_policy" {
+  description = "The systemd/Docker restart policy (e.g., 'always', 'on-failure', 'no')."
+  type        = string
+  default     = "always"
+}
+
+variable "container_env" {
+  description = "A map of environment variables to set in the container."
+  type        = map(string)
+  default     = {}
+}
+
+variable "container_command" {
+  description = "The optional command to override the ENTRYPOINT (e.g., '/bin/bash')."
+  type        = string
+  default     = ""
+}
+
+variable "container_args" {
+  description = "Optional arguments to pass to the container command."
+  type        = string
+  default     = ""
+}
+
+# Defaulting to COS, which has Docker/containerd pre-installed.
+variable "source_image_family" {
+  description = "The OS image family to use. COS is recommended."
+  type        = string
+  default     = "cos-stable"
+}
+
+variable "source_image_project" {
+  description = "The project hosting the source image."
+  type        = string
+  default     = "cos-cloud"
+}
+

From 8688c607f09119a5ab5f6adcfdcd1c2d7f4b1ca1 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:35:23 -0600
Subject: [PATCH 03/21] Create outputs.tf

---
 container-vm/outputs.tf | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 container-vm/outputs.tf

diff --git a/container-vm/outputs.tf b/container-vm/outputs.tf
new file mode 100644
index 0000000..7cadf9f
--- /dev/null
+++ b/container-vm/outputs.tf
@@ -0,0 +1,10 @@
+output "instance_template_self_link" {
+  description = "The self-link of the created instance template. Use this to deploy VMs or MIGs."
+  value       = google_compute_instance_template.container_vm_template.self_link
+}
+
+output "instance_template_name" {
+  description = "The name of the created instance template."
+  value       = google_compute_instance_template.container_vm_template.name
+}
+

From 5044f5442b5923cb4caab47a0178b54fada4f335 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:35:57 -0600
Subject: [PATCH 04/21] Create cloud-init.yaml.tftpl

---
 container-vm/cloud-init.yaml.tftpl | 56 ++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 container-vm/cloud-init.yaml.tftpl

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
new file mode 100644
index 0000000..2ef9be6
--- /dev/null
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -0,0 +1,56 @@
+#cloud-config
+# This cloud-init configuration defines a systemd service to run the Docker container
+# on Container-Optimized OS (COS).
+
+write_files:
+  - path: /etc/systemd/system/${container_name}.service
+    permissions: 0644
+    owner: root
+    content: |
+      [Unit]
+      Description=Containerized application: ${container_name}
+      # Wait for the Docker socket to be ready
+      Wants=docker.socket
+      After=docker.service
+      
+      [Service]
+      # Crucial for persistence: ensure the service restarts on exit.
+      Restart=${restart_policy}
+      RestartSec=5s
+      
+      # Stop and remove any pre-existing container with the same name.
+      ExecStartPre=/usr/bin/docker stop ${container_name} || true
+      ExecStartPre=/usr/bin/docker rm ${container_name} || true
+      
+      # Pull the latest version of the image before starting.
+      ExecStartPre=/usr/bin/docker pull ${container_image}
+      
+      # The main execution command: docker run.
+      # We use 'docker run --rm' to ensure clean removal after failure/stop.
+      ExecStart=/usr/bin/docker run --rm \
+        --name ${container_name} \
+        %{ for key, value in container_env ~}
+        -e ${key}=${value} \
+        %{ endfor ~}
+        ${container_image} \
+        %{ if container_command != "" ~}
+        ${container_command} \
+        %{ endif ~}
+        %{ if container_args != "" ~}
+        ${container_args} \
+        %{ endif ~}
+      
+      # ExecStop is called when the service is stopped manually.
+      ExecStop=/usr/bin/docker stop ${container_name}
+
+      [Install]
+      WantedBy=multi-user.target
+
+runcmd:
+  # Reload the systemd configuration to recognize the new service file.
+  - systemctl daemon-reload
+  # Enable the service to start automatically on subsequent boots.
+  - systemctl enable ${container_name}.service
+  # Start the service immediately.
+  - systemctl start ${container_name}.service
+

From 30b75fd65c1bcfeb8d188192a12e4bdbe4cacce1 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:42:44 -0600
Subject: [PATCH 05/21] Update cloud-init.yaml.tftpl

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index 2ef9be6..7c86627 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -30,7 +30,7 @@ write_files:
       ExecStart=/usr/bin/docker run --rm \
         --name ${container_name} \
         %{ for key, value in container_env ~}
-        -e ${key}=${value} \
+        -e ${key}="${value}" \
         %{ endfor ~}
         ${container_image} \
         %{ if container_command != "" ~}

From 461c61074016dd2cd47067f9acd77e6bdf43e958 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:43:13 -0600
Subject: [PATCH 06/21] Update variables.tf

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/variables.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 62a0d95..747aa5f 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -46,8 +46,8 @@ variable "container_command" {
 
 variable "container_args" {
   description = "Optional arguments to pass to the container command."
-  type        = string
-  default     = ""
+  type        = list(string)
+  default     = []
 }
 
 # Defaulting to COS, which has Docker/containerd pre-installed.

From 77f04f964b2b60003506b9d5c2293a6d12a4aea9 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:43:20 -0600
Subject: [PATCH 07/21] Update cloud-init.yaml.tftpl

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index 7c86627..bd4dc16 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -34,7 +34,7 @@ write_files:
         %{ endfor ~}
         ${container_image} \
         %{ if container_command != "" ~}
-        ${container_command} \
+        "${container_command}" \
         %{ endif ~}
         %{ if container_args != "" ~}
         ${container_args} \

From eced27bb664a3d90fc936008e7b1b9bd100bc3ea Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Thu, 27 Nov 2025 22:43:32 -0600
Subject: [PATCH 08/21] Update cloud-init.yaml.tftpl

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index bd4dc16..e18d050 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -36,8 +36,10 @@ write_files:
         %{ if container_command != "" ~}
         "${container_command}" \
         %{ endif ~}
-        %{ if container_args != "" ~}
-        ${container_args} \
+        %{ if length(container_args) > 0 ~}
+        %{ for arg in container_args ~}
+        '${replace(arg, "'", "'\\''")}' \
+        %{ endfor ~}
         %{ endif ~}
       
       # ExecStop is called when the service is stopped manually.

From ae9b8ff3da5e4dc31878fdac244db11277eda37e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 04:45:00 +0000
Subject: [PATCH 09/21] Initial plan


From 35ddd89c8bbdc6d1d86d08b9acaa475e80dbdf60 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 04:47:36 +0000
Subject: [PATCH 10/21] Require digest-based image reference and explicit
 service account

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/main.tf      |  2 +-
 container-vm/variables.tf | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/container-vm/main.tf b/container-vm/main.tf
index bd4787b..6767079 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -42,7 +42,7 @@ resource "google_compute_instance_template" "container_vm_template" {
 
   # Service Account configuration (needed for Google Cloud API access, including image pulls)
   service_account {
-    email  = "default" # Use the project's default compute service account
+    email  = var.service_account_email
     scopes = ["cloud-platform"]
   }
 
diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 747aa5f..c2a8c6e 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -16,8 +16,13 @@ variable "machine_type" {
 }
 
 variable "container_image" {
-  description = "The container image to run (e.g., 'nginx:latest' or 'gcr.io/my-project/my-app:v1')."
+  description = "The container image to run, must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:abc123...')."
   type        = string
+
+  validation {
+    condition     = can(regex("^.+@sha256:[a-f0-9]{64}$", var.container_image))
+    error_message = "The container_image must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:<64 hex chars>')."
+  }
 }
 
 variable "container_name" {
@@ -50,6 +55,11 @@ variable "container_args" {
   default     = []
 }
 
+variable "service_account_email" {
+  description = "The email of the service account to use for the VM. Must be created outside this module."
+  type        = string
+}
+
 # Defaulting to COS, which has Docker/containerd pre-installed.
 variable "source_image_family" {
   description = "The OS image family to use. COS is recommended."

From e3d44ad32651e6caf1d541e21093f10e9b488e70 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 05:04:58 +0000
Subject: [PATCH 11/21] Initial plan


From 6dbcb7ea4e25b13157b46cce9c3923e5418dbc86 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 05:06:41 +0000
Subject: [PATCH 12/21] Make VMs private and require network/subnetwork
 variables

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/main.tf      |  9 +++------
 container-vm/variables.tf | 10 ++++++++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/container-vm/main.tf b/container-vm/main.tf
index 6767079..41ec1a1 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -31,13 +31,10 @@ resource "google_compute_instance_template" "container_vm_template" {
     boot         = true
   }
 
-  # Network configuration
+  # Network configuration (private VM - no external IP)
   network_interface {
-    network    = "default" 
-    subnetwork = null      
-    
-    # Assign an external IP address (access_config is required for external IP)
-    access_config {}
+    network    = var.network
+    subnetwork = var.subnetwork
   }
 
   # Service Account configuration (needed for Google Cloud API access, including image pulls)
diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index c2a8c6e..4218a1a 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -73,3 +73,13 @@ variable "source_image_project" {
   default     = "cos-cloud"
 }
 
+variable "network" {
+  description = "The VPC network to attach the VM to."
+  type        = string
+}
+
+variable "subnetwork" {
+  description = "The subnetwork to attach the VM to."
+  type        = string
+}
+

From a0935d84215c8fe381d954037eab0048a8adf9a9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 05:07:16 +0000
Subject: [PATCH 13/21] Improve variable descriptions for network and
 subnetwork

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/variables.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 4218a1a..876fa93 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -74,12 +74,12 @@ variable "source_image_project" {
 }
 
 variable "network" {
-  description = "The VPC network to attach the VM to."
+  description = "The VPC network to attach the VM to (e.g., 'projects/PROJECT/global/networks/NETWORK' or 'NETWORK')."
   type        = string
 }
 
 variable "subnetwork" {
-  description = "The subnetwork to attach the VM to."
+  description = "The subnetwork to attach the VM to (e.g., 'projects/PROJECT/regions/REGION/subnetworks/SUBNET' or 'SUBNET')."
   type        = string
 }
 

From 2ecccd252957eb93f152ba520d063be2c517cd33 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Fri, 28 Nov 2025 09:26:29 -0600
Subject: [PATCH 14/21] Update cloud-init.yaml.tftpl

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index e18d050..eb61736 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -27,7 +27,7 @@ write_files:
       
       # The main execution command: docker run.
       # We use 'docker run --rm' to ensure clean removal after failure/stop.
-      ExecStart=/usr/bin/docker run --rm \
+      ExecStart=/usr/bin/docker run \
         --name ${container_name} \
         %{ for key, value in container_env ~}
         -e ${key}="${value}" \

From 928c05dbfe0c9cc5acf8d56795841528a90c33b6 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Fri, 28 Nov 2025 09:26:47 -0600
Subject: [PATCH 15/21] Update cloud-init.yaml.tftpl

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index eb61736..d591691 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -38,6 +38,8 @@ write_files:
         %{ endif ~}
         %{ if length(container_args) > 0 ~}
         %{ for arg in container_args ~}
+        # Escape single quotes in arguments by ending the quoted string, inserting an escaped quote, and resuming the quoted string.
+        # This pattern: replace(arg, "'", "'\\''") is standard for safely passing single quotes in shell.
         '${replace(arg, "'", "'\\''")}' \
         %{ endfor ~}
         %{ endif ~}

From 8ac9ed94701ed2f3b9b2c15c8f4e261e24320470 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 15:28:02 +0000
Subject: [PATCH 16/21] Initial plan


From 34662400c9ca6fdc4d60ad83155f4b92fd03ea77 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 15:32:45 +0000
Subject: [PATCH 17/21] Support multiple containers in structured format

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 62 +++++++++++++++---------------
 container-vm/main.tf               |  7 +---
 container-vm/variables.tf          | 52 +++++++++----------------
 3 files changed, 50 insertions(+), 71 deletions(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index d591691..0664dac 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -1,60 +1,60 @@
 #cloud-config
-# This cloud-init configuration defines a systemd service to run the Docker container
+# This cloud-init configuration defines systemd services to run Docker containers
 # on Container-Optimized OS (COS).
 
 write_files:
-  - path: /etc/systemd/system/${container_name}.service
+%{ for name, container in containers ~}
+  - path: /etc/systemd/system/${name}.service
     permissions: 0644
     owner: root
     content: |
       [Unit]
-      Description=Containerized application: ${container_name}
+      Description=Containerized application: ${name}
       # Wait for the Docker socket to be ready
       Wants=docker.socket
       After=docker.service
       
       [Service]
       # Crucial for persistence: ensure the service restarts on exit.
-      Restart=${restart_policy}
+      Restart=${container.restart_policy}
       RestartSec=5s
       
       # Stop and remove any pre-existing container with the same name.
-      ExecStartPre=/usr/bin/docker stop ${container_name} || true
-      ExecStartPre=/usr/bin/docker rm ${container_name} || true
+      ExecStartPre=/usr/bin/docker stop ${name} || true
+      ExecStartPre=/usr/bin/docker rm ${name} || true
       
-      # Pull the latest version of the image before starting.
-      ExecStartPre=/usr/bin/docker pull ${container_image}
+      # Pull the image before starting.
+      ExecStartPre=/usr/bin/docker pull ${container.image}
       
       # The main execution command: docker run.
-      # We use 'docker run --rm' to ensure clean removal after failure/stop.
       ExecStart=/usr/bin/docker run \
-        --name ${container_name} \
-        %{ for key, value in container_env ~}
-        -e ${key}="${value}" \
-        %{ endfor ~}
-        ${container_image} \
-        %{ if container_command != "" ~}
-        "${container_command}" \
-        %{ endif ~}
-        %{ if length(container_args) > 0 ~}
-        %{ for arg in container_args ~}
-        # Escape single quotes in arguments by ending the quoted string, inserting an escaped quote, and resuming the quoted string.
-        # This pattern: replace(arg, "'", "'\\''") is standard for safely passing single quotes in shell.
+        --name ${name} \
+%{ for e in container.env ~}
+        -e ${e.name}="${e.value}" \
+%{ endfor ~}
+        ${container.image} \
+%{ if container.command != "" ~}
+        "${container.command}" \
+%{ endif ~}
+%{ for arg in container.args ~}
         '${replace(arg, "'", "'\\''")}' \
-        %{ endfor ~}
-        %{ endif ~}
+%{ endfor ~}
+
       
       # ExecStop is called when the service is stopped manually.
-      ExecStop=/usr/bin/docker stop ${container_name}
+      ExecStop=/usr/bin/docker stop ${name}
 
       [Install]
       WantedBy=multi-user.target
 
-runcmd:
-  # Reload the systemd configuration to recognize the new service file.
-  - systemctl daemon-reload
-  # Enable the service to start automatically on subsequent boots.
-  - systemctl enable ${container_name}.service
-  # Start the service immediately.
-  - systemctl start ${container_name}.service
+%{ endfor ~}
+
+runcmd:
+  # Reload the systemd configuration to recognize the new service files.
+  - systemctl daemon-reload
+%{ for name, container in containers ~}
+  # Enable and start ${name} service.
+  - systemctl enable ${name}.service
+  - systemctl start ${name}.service
+%{ endfor ~}
 
diff --git a/container-vm/main.tf b/container-vm/main.tf
index 41ec1a1..31d9812 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -7,12 +7,7 @@ data "google_compute_image" "source_image" {
 # Render the cloud-init YAML template using dynamic module inputs
 locals {
   rendered_cloud_init = templatefile("${path.module}/cloud-init.yaml.tftpl", {
-    container_name    = var.container_name,
-    container_image   = var.container_image,
-    restart_policy    = var.restart_policy,
-    container_env     = var.container_env,
-    container_command = var.container_command,
-    container_args    = var.container_args,
+    containers = var.containers,
   })
 }
 
diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 876fa93..0f2334b 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -15,44 +15,28 @@ variable "machine_type" {
   default     = "e2-medium"
 }
 
-variable "container_image" {
-  description = "The container image to run, must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:abc123...')."
-  type        = string
+variable "containers" {
+  description = "A map of containers to run on the VM. Each key is the container name, and the value specifies the container configuration."
+  type = map(object({
+    image   = string
+    command = optional(string, "")
+    args    = optional(list(string), [])
+    env = optional(list(object({
+      name  = string
+      value = string
+    })), [])
+    restart_policy = optional(string, "always")
+  }))
 
   validation {
-    condition     = can(regex("^.+@sha256:[a-f0-9]{64}$", var.container_image))
-    error_message = "The container_image must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:<64 hex chars>')."
+    condition     = length(var.containers) > 0
+    error_message = "At least one container must be specified."
   }
-}
 
-variable "container_name" {
-  description = "The name to assign to the running Docker container."
-  type        = string
-  default     = "gce-container-app"
-}
-
-variable "restart_policy" {
-  description = "The systemd/Docker restart policy (e.g., 'always', 'on-failure', 'no')."
-  type        = string
-  default     = "always"
-}
-
-variable "container_env" {
-  description = "A map of environment variables to set in the container."
-  type        = map(string)
-  default     = {}
-}
-
-variable "container_command" {
-  description = "The optional command to override the ENTRYPOINT (e.g., '/bin/bash')."
-  type        = string
-  default     = ""
-}
-
-variable "container_args" {
-  description = "Optional arguments to pass to the container command."
-  type        = list(string)
-  default     = []
+  validation {
+    condition     = alltrue([for name, c in var.containers : can(regex("^.+@sha256:[a-f0-9]{64}$", c.image))])
+    error_message = "All container images must be referenced by digest (e.g., 'gcr.io/my-project/my-app@sha256:<64 hex chars>')."
+  }
 }
 
 variable "service_account_email" {

From f10dc3945544a54471f328906182c1310257c8af Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 15:33:54 +0000
Subject: [PATCH 18/21] Add comment explaining single quote escaping in
 container args

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index 0664dac..6f5128c 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -37,6 +37,7 @@ write_files:
         "${container.command}" \
 %{ endif ~}
 %{ for arg in container.args ~}
+        # Escape single quotes: end quoted string, add escaped quote, resume quoted string
         '${replace(arg, "'", "'\\''")}' \
 %{ endfor ~}
 

From ebe751f941a33a18dea7e23d6502839af34c2d91 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 19:00:39 +0000
Subject: [PATCH 19/21] Initial plan


From 6f0fafb978858d65b57de2b4ea6c14a9824c7dad Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 19:03:34 +0000
Subject: [PATCH 20/21] Add comprehensive observability support (logs, metrics,
 traces)

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl |  9 ++++++++-
 container-vm/main.tf               | 19 ++++++++++++++++---
 container-vm/variables.tf          | 25 +++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index 6f5128c..4dbed52 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -1,6 +1,6 @@
 #cloud-config
 # This cloud-init configuration defines systemd services to run Docker containers
-# on Container-Optimized OS (COS).
+# on Container-Optimized OS (COS) with full observability support.
 
 write_files:
 %{ for name, container in containers ~}
@@ -27,8 +27,15 @@ write_files:
       ExecStartPre=/usr/bin/docker pull ${container.image}
       
       # The main execution command: docker run.
+      # When logging is enabled, use the gcplogs driver to send container logs to Cloud Logging.
       ExecStart=/usr/bin/docker run \
         --name ${name} \
+%{ if enable_logging ~}
+        --log-driver=gcplogs \
+        --log-opt gcp-project=${project_id} \
+        --log-opt labels=container_name \
+        --label container_name=${name} \
+%{ endif ~}
 %{ for e in container.env ~}
         -e ${e.name}="${e.value}" \
 %{ endfor ~}
diff --git a/container-vm/main.tf b/container-vm/main.tf
index 31d9812..ffac837 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -7,7 +7,9 @@ data "google_compute_image" "source_image" {
 # Render the cloud-init YAML template using dynamic module inputs
 locals {
   rendered_cloud_init = templatefile("${path.module}/cloud-init.yaml.tftpl", {
-    containers = var.containers,
+    containers     = var.containers,
+    enable_logging = var.enable_logging,
+    project_id     = var.project_id,
   })
 }
 
@@ -18,6 +20,7 @@ resource "google_compute_instance_template" "container_vm_template" {
   description  = "Runs a container using Docker, managed by a systemd unit via cloud-init."
   machine_type = var.machine_type
   region       = var.region
+  labels       = var.labels
   
   # Disk configuration using the fetched OS image
   disk {
@@ -38,14 +41,24 @@ resource "google_compute_instance_template" "container_vm_template" {
     scopes = ["cloud-platform"]
   }
 
-  # Critical step: inject the cloud-init script via the 'user-data' metadata key.
+  # Metadata for cloud-init and observability
   metadata = {
-    user-data = local.rendered_cloud_init
+    user-data                  = local.rendered_cloud_init
+    google-logging-enabled     = var.enable_logging
+    google-monitoring-enabled  = var.enable_monitoring
+    cos-metrics-enabled        = var.enable_cos_metrics
   }
 
   scheduling {
     automatic_restart   = true
     on_host_maintenance = "MIGRATE"
   }
+
+  # Enable shielded VM features for security
+  shielded_instance_config {
+    enable_secure_boot          = true
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
 }
 
diff --git a/container-vm/variables.tf b/container-vm/variables.tf
index 0f2334b..327bd72 100644
--- a/container-vm/variables.tf
+++ b/container-vm/variables.tf
@@ -67,3 +67,28 @@ variable "subnetwork" {
   type        = string
 }
 
+# Observability variables
+variable "enable_logging" {
+  description = "Enable Cloud Logging for the VM and containers. When true, container logs are sent to Cloud Logging using the gcplogs driver."
+  type        = bool
+  default     = true
+}
+
+variable "enable_monitoring" {
+  description = "Enable Cloud Monitoring for the VM. When true, VM metrics are collected and sent to Cloud Monitoring."
+  type        = bool
+  default     = true
+}
+
+variable "enable_cos_metrics" {
+  description = "Enable Container-Optimized OS metrics collection for additional container and system metrics."
+  type        = bool
+  default     = true
+}
+
+variable "labels" {
+  description = "Labels to apply to the instance template for organization and filtering in Cloud Monitoring and Logging."
+  type        = map(string)
+  default     = {}
+}
+

From 053d647d4e90a7fd1b4fbb5f23370b48f47cc21f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 19:04:26 +0000
Subject: [PATCH 21/21] Fix metadata types and enhance gcplogs configuration

Co-authored-by: imjasonh <210737+imjasonh@users.noreply.github.com>
---
 container-vm/cloud-init.yaml.tftpl | 3 +++
 container-vm/main.tf               | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/container-vm/cloud-init.yaml.tftpl b/container-vm/cloud-init.yaml.tftpl
index 4dbed52..520034d 100644
--- a/container-vm/cloud-init.yaml.tftpl
+++ b/container-vm/cloud-init.yaml.tftpl
@@ -33,6 +33,9 @@ write_files:
 %{ if enable_logging ~}
         --log-driver=gcplogs \
         --log-opt gcp-project=${project_id} \
+        --log-opt gcp-log-cmd=true \
+        --log-opt gcp-meta-zone=true \
+        --log-opt gcp-meta-name=true \
         --log-opt labels=container_name \
         --label container_name=${name} \
 %{ endif ~}
diff --git a/container-vm/main.tf b/container-vm/main.tf
index ffac837..92bad48 100644
--- a/container-vm/main.tf
+++ b/container-vm/main.tf
@@ -44,9 +44,9 @@ resource "google_compute_instance_template" "container_vm_template" {
   # Metadata for cloud-init and observability
   metadata = {
     user-data                  = local.rendered_cloud_init
-    google-logging-enabled     = var.enable_logging
-    google-monitoring-enabled  = var.enable_monitoring
-    cos-metrics-enabled        = var.enable_cos_metrics
+    google-logging-enabled     = tostring(var.enable_logging)
+    google-monitoring-enabled  = tostring(var.enable_monitoring)
+    cos-metrics-enabled        = tostring(var.enable_cos_metrics)
   }
 
   scheduling {