TDX on GCP Bare‑Metal: the tiny difference that unlocks it

Here’s the situation. You want a TDX host on Google Cloud—not a guest, not a “confidential VM,” but a real bare‑metal box that can launch TD guests under your control. Maybe you’ve got startup credits to burn and would rather spend Google’s money than rack your own servers. The pieces exist, but the path is… let’s say “under‑advertised.” After a few dead ends, the thing that finally made it click was almost comically small: a two‑line diff in Canonical’s tdx repo to use the GCP kernel flavour and a PPA that actually ships it with TDX. Once you know that, the rest flows.

What follows is the complete, copy‑pasteable flow with enough context that you won’t have to guess why it works.

We start by provisioning C3 bare‑metal with the IDPF NIC. On GCP, bare‑metal means no gVNIC/VirtIO, no live migration, and Shielded VM niceties don’t apply. Use TERMINATE for maintenance, point at a fresh Ubuntu 24.04 image, and give yourself a decent disk.

gcloud compute instances create tdx-bm-test \

--project="$PROJECT" \

--zone=asia-southeast1-c \

--machine-type=c3-highcpu-192-metal \

--network-interface=nic-type=IDPF \

--maintenance-policy=TER

MINATE \

--no-shielded-secure-boot \

--create-disk=boot=yes,image=projects/ubuntu-os-cloud/global/images/ubuntu-2404-noble-amd64-v20241115,provisioned-throughput=512,provisioned-iops=120000,size=1000GB,type=hyperdisk-balanced,auto-delete=yes,mode=rw

Boot it, SSH in, and grab the repo

git clone https://github.com/canonical/tdx.git cd tdx

Canonical’s canonical/tdx repository already knows how to set up a TDX host. The reason it doesn’t “just work” on GCP is that the default assumes the Intel kernel flavour; GCP Ubuntu images live on the linux-gcp flavour.

Now the entire trick—the two lines:

diff --git a/setup-tdx-config b/setup-tdx-config

- TDX_PPA="tdx-release"

+ TDX_PPA="ppa:tswhison/gcp-tdx"

diff --git a/setup-tdx-host.sh b/setup-tdx-host.sh

- KERNEL_TYPE=linux-image-intel

+ KERNEL_TYPE=linux-gcp

If you prefer not to open an editor:

sed -i 's|^TDX_PPA=.*|TDX_PPA="ppa:tswhison/gcp-tdx"|' setup-tdx-config

sed -i 's|^KERNEL_TYPE=.*|KERNEL_TYPE=linux-gcp|' setup-tdx-host.sh

And then let the script do its thing:

sudo ./setup-tdx-host.sh

sudo reboot

That’s it. You’ve told the installer to pull a GCP‑flavoured kernel from a PPA that actually publishes linux-gcp with TDX host enablement, instead of pulling an Intel‑flavoured kernel that doesn’t match the rest of the image.

After the reboot, confirm you’re on the right track. Look for TDX coming up in the logs:

# Expect a line like: "virt/tdx: module initialized"

dmesg | grep -i tdx

If this look good, you’ve got a TDX‑capable host ready to launch TD guests.

Under the covers, you solved two mismatches:

• Kernel flavour: Ubuntu on Google Compute Engine is built and tested around linux-gcp. It carries the drivers, packaging, and ABI GCP expects. Swapping in linux-image-intel might bring some enablement early, but you’re swimming upstream against everything else in the image. Setting KERNEL_TYPE=linux-gcp pulls you back into the flow GCP actually uses.

• Where it comes from: the stock tdx-release points you at a PPA that’s great for the Intel flavour; it doesn’t publish the GCP flavour you need. The ppa:tswhison/gcp-tdx PPA does—conveniently shipping linux-gcpalong with its meta-package (linux-meta-gcp) and, if Secure Boot is enabled, the signed variant (linux-signed-gcp) that include the TDX host bits. Flip the PPA, stay on the platform kernel, and the rest just lines up.

When people say “TDX on GCP is possible, but kind of esoteric,” this is the missing breadcrumb. It’s not that the pieces are unstable; it’s that the default script aims at the wrong flavour for this platform.

If dmesg is silent about TDX, you probably didn’t boot the new kernel. Check your GRUB configuration to make sure you are booting into the right kernel by default.

If you’re sitting on GCP credits, this route is a sweet spot: real TDX host control without buying hardware, and performance that behaves like… well, bare‑metal. The setup isn’t complicated; it’s just not in one place. Use the platform’s kernel (linux-gcp), pull it from a PPA that ships TDX for that flavour, and the Canonical scripts do the heavy lifting.

Two lines. One reboot. A TDX host on GCP.

Huge thanks to the GitHub contributor who nudged us in the right direction on this issue—that breadcrumb made the two‑line diff obvious in hindsight. And a hat tip to Kunal Limaye from Google for the many hints along the way, even though bare‑metal TDX isn’t officially supported on GCP.