Skip to main content

Cloud Run

1 - Overview​

Cloud Run is a serverless platform for running containers without managing infrastructure.

2 - Services vs Jobs​

TypeDescriptionUsage
ServiceLong-running HTTP containerAPIs, Web apps
JobOne-shot batch containerScheduled tasks, migrations

3 - Deploy a service​

3.1 From an image​

# Deploy
gcloud run deploy my-service \
    --image=europe-west1-docker.pkg.dev/mon-projet/images/my-app:v1.0.0 \
    --region=europe-west1 \
    --platform=managed \
    --allow-unauthenticated \
    --port=8080 \
    --cpu=1 \
    --memory=512Mi \
    --min-instances=0 \
    --max-instances=10

3.2 From source code​

# Automatic build and deploy
gcloud run deploy my-service \
    --source=. \
    --region=europe-west1

3.3 Via Cloud Build​

# cloudbuild.yaml
steps:
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - 'build'
      - '-t'
      - 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/my-app:$COMMIT_SHA'
      - '.'
  
  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', 'europe-west1-docker.pkg.dev/$PROJECT_ID/images/my-app:$COMMIT_SHA']
  
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: 'gcloud'
    args:
      - 'run'
      - 'deploy'
      - 'my-service'
      - '--image=europe-west1-docker.pkg.dev/$PROJECT_ID/images/my-app:$COMMIT_SHA'
      - '--region=europe-west1'
      - '--platform=managed'

4 - Configuration​

4.1 Resources​

gcloud run services update my-service \
    --cpu=2 \
    --memory=1Gi \
    --concurrency=80 \
    --timeout=300 \
    --region=europe-west1

4.2 Scaling​

# Min and max instances
gcloud run services update my-service \
    --min-instances=1 \
    --max-instances=100 \
    --region=europe-west1

4.3 Environment variables​

gcloud run services update my-service \
    --set-env-vars="NODE_ENV=production,LOG_LEVEL=info" \
    --region=europe-west1

4.4 Secrets​

# Use a secret from Secret Manager
gcloud run services update my-service \
    --set-secrets="API_KEY=api-key:latest" \
    --region=europe-west1

# Mount as a file
gcloud run services update my-service \
    --set-secrets="/secrets/config=config-secret:latest" \
    --region=europe-west1

5 - Traffic Management​

5.1 Canary deployment​

# Deploy without traffic
gcloud run deploy my-service \
    --image=new-image:v2 \
    --no-traffic \
    --region=europe-west1

# Send 10% of traffic
gcloud run services update-traffic my-service \
    --to-revisions=my-service-00002=10 \
    --region=europe-west1

# Promote to 100%
gcloud run services update-traffic my-service \
    --to-latest \
    --region=europe-west1

5.2 Revision tags​

# Tag a revision
gcloud run services update-traffic my-service \
    --to-tags=canary=my-service-00002 \
    --region=europe-west1

# URL: https://canary---my-service-xxxxx.run.app

6 - Jobs​

6.1 Create a job​

gcloud run jobs create my-job \
    --image=europe-west1-docker.pkg.dev/mon-projet/images/batch:v1 \
    --region=europe-west1 \
    --tasks=10 \
    --parallelism=5 \
    --task-timeout=3600 \
    --max-retries=3

6.2 Run a job​

# Manual execution
gcloud run jobs execute my-job --region=europe-west1

# Scheduled execution (Cloud Scheduler)
gcloud scheduler jobs create http my-scheduled-job \
    --schedule="0 2 * * *" \
    --uri="https://europe-west1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/mon-projet/jobs/my-job:run" \
    --http-method=POST \
    --oauth-service-account-email=scheduler-sa@mon-projet.iam.gserviceaccount.com

7 - Custom domains​

7.1 Map a domain​

# Verify the domain
gcloud domains verify example.com

# Map
gcloud run domain-mappings create \
    --service=my-service \
    --domain=app.example.com \
    --region=europe-west1

7.2 SSL certificate​

Cloud Run automatically provides a managed SSL certificate for custom domains.

8 - Authentication​

8.1 Public access​

gcloud run services update my-service \
    --allow-unauthenticated \
    --region=europe-west1

8.2 Authenticated access​

# Restrict access
gcloud run services update my-service \
    --no-allow-unauthenticated \
    --region=europe-west1

# Grant access to a user
gcloud run services add-iam-policy-binding my-service \
    --member="user:[email protected]" \
    --role="roles/run.invoker" \
    --region=europe-west1

# Grant access to a service account
gcloud run services add-iam-policy-binding my-service \
    --member="serviceAccount:[email protected]" \
    --role="roles/run.invoker" \
    --region=europe-west1

8.3 Service-to-service call​

# Python
import google.auth.transport.requests
import google.oauth2.id_token

def call_cloud_run_service():
    auth_req = google.auth.transport.requests.Request()
    id_token = google.oauth2.id_token.fetch_id_token(
        auth_req, 
        "https://my-service-xxxxx.run.app"
    )
    
    response = requests.get(
        "https://my-service-xxxxx.run.app/api/data",
        headers={"Authorization": f"Bearer {id_token}"}
    )
    return response.json()

9 - Pricing​

ResourcePrice
vCPU$0.00002400/vCPU-second
Memory$0.00000250/GiB-second
Requests$0.40/million

Monthly free tier:

  • 2 million requests
  • 360,000 GiB-seconds of memory
  • 180,000 vCPU-seconds

Summary​

In this chapter, we learned:

  • Services vs Jobs
  • Deploying containers
  • Configuration (resources, scaling, secrets)
  • Traffic Management (canary)
  • Jobs for batch tasks
  • Authentication

Next step​

In the next chapter, we will look at Cloud Monitoring and Logging.

→ Next chapter: Monitoring and Logging

← Back to table of contents