cloud-run

Cloud Run

Deploy and manage containerized applications on Google Cloud Run — fully managed, serverless, and scales to zero.

Prerequisites

• gcloud CLI authenticated (gcloud auth login or ADC)
• Project set: gcloud config set project PROJECT_ID
• APIs enabled: gcloud services enable run.googleapis.com

Core Patterns

Deploy a container

# Billable action — confirm before running
gcloud run deploy SERVICE_NAME \
  --image IMAGE_URI \
  --region REGION \
  --platform managed \
  --no-allow-unauthenticated

Grant invoker access (least-privilege)

gcloud run services add-iam-policy-binding SERVICE_NAME \
  --region REGION \
  --member="serviceAccount:[email protected]" \
  --role="roles/run.invoker"

VPC connector (private connectivity)

gcloud run services update SERVICE_NAME \
  --vpc-connector CONNECTOR_NAME \
  --region REGION

Mount a secret

gcloud run services update SERVICE_NAME \
  --set-secrets=/path/to/secret=SECRET_NAME:latest \
  --region REGION

Safety Rules

• Never use --allow-unauthenticated without explicit intent and gcp-security sign-off
• Always specify --no-allow-unauthenticated as the default
• Cost warning: Cloud Run bills per request and per CPU/memory allocated — estimate before deploying high-traffic services

References

• Cloud Run Overview
• Cloud Run IAM
• Cloud Run Pricing
• Cloud Run General Development Tips
• gcloud run reference
• Cloud Run Release Notes