Bootstrapping and maintaining a Google Cloud organization · Topic 6 of 6
Cloud Workstations, Cloud Shell and Gemini for Developers and Operators
Set up secure developer environments with Cloud Workstations and Cloud Shell, custom images and tooling, and Gemini Code Assist, Cloud Assist and CLI.
- 5 min
- Cloud Workstations: cluster (region, VPC), configuration (image, machine, timeouts), workstation.
- Custom images extend Google's predefined images; rebuild and push them on a schedule.
- Private clusters, no public IP and VPC Service Controls keep code in your network.
What it is
Developers need somewhere to write and test code that has the right tools and can reach private resources, without copying source code and credentials to unmanaged laptops. Google Cloud offers two managed options: Cloud Workstations for full, configurable development environments, and Cloud Shell for quick command-line work.
The exam also lists Gemini assistants that help with writing code and operating services.
How it works
Cloud Workstations
Cloud Workstations runs development environments on Google Cloud, managed centrally. Code stays inside your project and network.
| Resource | What it defines |
|---|---|
| Workstation cluster | The region and VPC network the workstations run in; can use private endpoints |
| Workstation configuration | Machine type, container image, persistent disk, idle and running timeouts, public IP or not, who can use it |
| Workstation | One developer's environment created from a configuration |
Access is controlled by IAM: give developers the Cloud Workstations Creator role on a configuration so they can create workstations from it; each creator automatically gets the Cloud Workstations User role on the workstations they create. Administrators manage clusters and configurations.
| Security control | Effect |
|---|---|
| Private cluster and no public IP | Workstations reach only your VPC and approved routes |
| VPC Service Controls | Data cannot be moved out of the perimeter |
| Idle timeout | Unused workstations stop, which also saves money |
| Running timeout | Forces a restart, picking up the latest image |
| Dedicated service account on the configuration | The workstation calls Google APIs with limited roles |
| Audit logging | Access to workstations is recorded |
Bootstrapping with custom images
Each workstation runs a container image. Google provides predefined images with IDEs such as Code OSS and JetBrains IDEs, plus the Cloud SDK. To add your own tooling, build a custom image on top of one of them.
FROM us-central1-docker.pkg.dev/cloud-workstations-images/predefined/code-oss:latest
RUN apt-get update && apt-get install -y --no-install-recommends make jq \
&& rm -rf /var/lib/apt/lists/*
COPY company-ca.crt /usr/local/share/ca-certificates/company-ca.crt
RUN update-ca-certificatesBuild the image in Cloud Build on a schedule, push it to Artifact Registry and point the configuration at it. Because workstations restart from the image, every developer gets the same patched tools, while the home directory on the persistent disk keeps their work.
Cloud Shell
Cloud Shell is a browser terminal on a temporary VM with the Google Cloud CLI, kubectl, Terraform and common languages already installed, plus a small persistent home directory and the Cloud Shell Editor. It runs as the signed-in user.
| Need | Choose |
|---|---|
| Quick admin commands, tutorials, short tasks | Cloud Shell |
| Daily development with a team-wide toolchain and private network access | Cloud Workstations |
| Heavy builds or GPUs for development | Cloud Workstations with a larger machine type |
Administrators can disable Cloud Shell for the organization in the Admin console when policy forbids it.
Leveraging AI with Gemini
| Tool | Where it works | Helps with |
|---|---|---|
| Gemini Code Assist | IDEs such as VS Code, JetBrains IDEs and Cloud Workstations | Code completion, generating code and tests, explaining code, chat |
| Gemini Cloud Assist | Google Cloud console | Designing, operating and troubleshooting: explaining logs and errors, investigations, cost questions |
| Gemini CLI | The terminal | An AI agent that reads files, runs commands and edits code from the command line |
Gemini Code Assist Enterprise can use your private repositories to tailor suggestions. Treat AI output like any other change: it still goes through review, tests and the pipeline.
A worked example
A bank forbids source code on laptops. The engineer creates a workstation cluster in a private subnet with no public IPs, inside a VPC Service Controls perimeter.
A custom image built weekly from the Code OSS image adds the company CA certificate, linters and Terraform. The configuration has a two hour idle timeout and a dedicated service account, and developers use Gemini Code Assist in the workstation IDE.
How the exam asks about this
- "Developers must not keep source code on local machines but need a full IDE with access to private services." Use Cloud Workstations in a private cluster.
- "All developers must get the same internal tools and security patches automatically." Build a custom workstation image in a pipeline and set it on the configuration.
- "An operator wants an AI explanation of an error log entry in the console." Use Gemini Cloud Assist.
What to remember for the exam
- Cloud Workstations: cluster (region, VPC), configuration (image, machine, timeouts), workstation.
- Custom images extend Google's predefined images; rebuild and push them on a schedule.
- Private clusters, no public IP and VPC Service Controls keep code in your network.
- Cloud Shell is for quick tasks as the signed-in user, not a managed team environment.
- Gemini Code Assist helps write code; Gemini Cloud Assist helps operate in the console; Gemini CLI works in the terminal.
A workstation keeps running its old image until it restarts. Set a running timeout or restart workstations after a security update to the image.
Common mistakes
Installing tools by hand on each workstation. Environments drift and patches are missed. Put tools in the custom image.
Using Cloud Shell as the team's main development environment. It is temporary, per user and not configured centrally. Use Cloud Workstations.
Granting developers broad project roles to use workstations. They only need the Cloud Workstations Creator role on the configuration.
Check yourself
Which resource sets the container image and idle timeout for workstations?
The workstation configuration, which also sets the machine type, disk and whether workstations get public IP addresses.
How do you give every developer a new tool in their workstation?
Add it to the custom container image, push the image to Artifact Registry and let workstations restart with it.
Which Gemini tool helps an operator troubleshoot in the Google Cloud console?
Gemini Cloud Assist, which can explain logs and errors and run investigations.
Topic 6 of 6 in Bootstrapping and maintaining a Google Cloud organization
Test yourself on Bootstrapping and maintaining a Google Cloud organization
The full Google Cloud Professional Cloud DevOps Engineer question bank has 751 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.