# Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImage'.

- **ID:** `policy/gcp-compute-restrict-noncompliant-image`
- **Domain:** policy
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 72%

## Root Cause

GCP Organization Policy constraints/compute.restrictNoncompliantImage blocks the use of images that are not approved or do not meet compliance standards.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Google Compute Engine 2024-03 | active | — | — |
| gcloud 450.0.0 | active | — | — |

## Workarounds

1. **Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`** (85% success)
   ```
   Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`
   ```
2. **Request an exception from the organization policy administrator to allow the specific image.** (70% success)
   ```
   Request an exception from the organization policy administrator to allow the specific image.
   ```
3. **Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it.** (75% success)
   ```
   Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it.
   ```

## Dead Ends

- **** — The policy checks the image's compliance status, not just the name; using another noncompliant image will also fail. (85% fail)
- **** — Requires org-level admin permissions and may violate compliance requirements. (90% fail)
- **** — Public access does not override organization policies; the policy still applies. (95% fail)