Right now we're working with a Google-hardened Ubuntu image; same one we use for GKE. COS is still TBD.