Confidential Space Model Image Boot Disk Full

When a confidential VM pulls or extracts a container image with baked model weights, the workload can die before app logs start. Treat this as a boot-disk admission and delivery-mode decision, not a generic runner cleanup problem.

Runbook: Fail Before The Confidential VM Starts

1. Document the supported delivery modes: single-model bake, two-model encrypted runtime delivery, or explicitly-sized boot disk.
2. Estimate extracted bytes, not only compressed image size. Model layers, runtime packages, OS reserve, logs, temp, and decompression overhead share the boot disk.
3. Add a deploy preflight that rejects combinations such as MODEL_URL plus EMBED_MODEL_URL when they exceed the documented boot-disk budget.
4. If a boot-disk-size variable is added, make the minimum size calculation visible in docs and examples.
5. Put the Cloud Logging signature next to other silent-start failure modes: write /models/... no space left on device, missing app logs, and self-termination after image extraction.
6. Keep encrypted delivery as the default for large or gated model weights so sensitive artifacts do not become permanent image layers.

I would make the acceptance criteria explicit around a size-budget preflight, not only docs.

Suggested boundary:

- One model baked into the image is allowed only if extracted image bytes + OS/runtime reserve fit the default boot disk.
- Two large model artifacts should default to encrypted runtime delivery into /models or tmpfs unless a boot-disk-size variable is set.
- Deployment should fail before launch when MODEL_URL + EMBED_MODEL_URL exceed the documented boot-disk budget.
- The silent-termination docs should include the Cloud Logging signature: write /models/... no space left on device, followed by the workload never starting.
- If a boot-disk-size knob is added, document the minimum-size formula and add a fixture with two model sizes that would fail on the default disk.

Do Not Delete Or Rebuild Blindly

• Gated model weights that are expensive or sensitive to rehydrate.
• Attestation, encryption, or delivery-path evidence that explains why the workload never started.
• Cloud Logging entries that identify image extraction ENOSPC before application logs begin.
• Runtime tmpfs or encrypted-delivery paths before confirming what the model server actually expects.