Release should not be final
GCE requires fresh kernel
We do not need to harden SSH for GCE