diff --git a/bin/tdx-test/src/main.rs b/bin/tdx-test/src/main.rs
index 217b5c2..539f859 100644
--- a/bin/tdx-test/src/main.rs
+++ b/bin/tdx-test/src/main.rs
@@ -46,7 +46,8 @@ enum AppError {
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let config = load_config_with_telemetry(|config: &AppConfig| &config.telemetry).await?;
+    let config =
+        load_config_with_telemetry("APP".into(), |config: &AppConfig| &config.telemetry).await?;
 
     loop {
         error!(?config, "error test!");
diff --git a/crates/teepot/src/config/mod.rs b/crates/teepot/src/config/mod.rs
index b5f7595..5cf24a0 100644
--- a/crates/teepot/src/config/mod.rs
+++ b/crates/teepot/src/config/mod.rs
@@ -170,27 +170,35 @@ fn protocol_from_string(protocol: &str) -> Result<opentelemetry_otlp::Protocol,
 pub async fn load_config_with_telemetry<
     S: Default + Serialize + for<'a> Deserialize<'a> + Send + 'static,
 >(
+    env_prefix: String,
     get_telemetry_config: fn(&S) -> &TelemetryConfig,
 ) -> Result<S, Box<dyn std::error::Error + Send + Sync>> {
     with_console_logging(async move {
         trace!("Loading config");
         // Load configuration
-        let config = ConfigBuilder::<AsyncState>::default()
-            .add_source(Config::try_from(&S::default())?)
-            .add_source(File::with_name("config/default").required(false))
-            .add_source(
-                config::Environment::with_prefix("APP")
-                    .try_parsing(true)
-                    .separator("_"),
-            )
-            .add_async_source(HttpSource {
-                uri: DEFAULT_INSTANCE_METADATA_BASE_URL.into(),
-                format: FileFormat::Json,
-                required: false,
-            })
-            .build()
-            .await?
-            .try_deserialize::<S>()?;
+        let config = {
+            let c = ConfigBuilder::<AsyncState>::default()
+                .add_source(Config::try_from(&S::default())?)
+                .add_source(File::with_name("config/default").required(false))
+                .add_source(
+                    config::Environment::with_prefix(&env_prefix)
+                        .try_parsing(true)
+                        .separator("_"),
+                );
+
+            if std::env::var_os("GOOGLE_METADATA").is_some() {
+                c.add_async_source(HttpSource {
+                    uri: DEFAULT_INSTANCE_METADATA_BASE_URL.into(),
+                    format: FileFormat::Json,
+                    required: false,
+                })
+                .build()
+                .await?
+                .try_deserialize::<S>()?
+            } else {
+                c.build().await?.try_deserialize::<S>()?
+            }
+        };
 
         // Initialize telemetry
         init_telemetry(get_telemetry_config(&config))?;
diff --git a/packages/tdx_google/configuration.nix b/packages/tdx_google/configuration.nix
index 9c6b663..9111999 100644
--- a/packages/tdx_google/configuration.nix
+++ b/packages/tdx_google/configuration.nix
@@ -85,23 +85,36 @@
   systemd.services.docker_start_container = {
     description = "The main application container";
     wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" "docker.service" ];
-    requires = [ "network-online.target" "docker.service" ];
+    after = [ "network-online.target" "docker.service" "vector.service" "chronyd.service" ];
+    requires = [ "network-online.target" "docker.service" "vector.service" ];
     serviceConfig = {
       Type = "exec";
       User = "root";
+      EnvironmentFile = "-/run/container/env";
+      ExecStartPre = "+" + toString (
+        pkgs.writeShellScript "container-start-pre" ''
+          set -eu -o pipefail
+          : "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
+          : "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
+          : "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
+          : "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
+
+          : "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
+          : "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
+
+          mkdir -p /run/container
+          cat >/run/container/env <<EOF
+          CONTAINER_IMAGE="''${CONTAINER_IMAGE}"
+          CONTAINER_HUB="''${CONTAINER_HUB}"
+          CONTAINER_USER="''${CONTAINER_USER}"
+          CONTAINER_TOKEN="''${CONTAINER_TOKEN}"
+          EOF
+        ''
+      );
     };
     path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ];
     script = ''
       set -eu -o pipefail
-      : "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
-      : "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
-      : "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
-      : "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
-
-      : "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
-      : "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
-
       if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then
         docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB"
       fi
@@ -111,7 +124,7 @@
       DIGEST=''${DIGEST#sha256:}
       echo "Measuring $DIGEST" >&2
       test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
-      exec docker run --network=host --init --privileged "sha256:$DIGEST"
+      exec docker run --env "GOOGLE_METADATA=1" --network=host --init --privileged "sha256:$DIGEST"
     '';
 
     postStop = lib.mkDefault ''