Serverless Containers with Cloud Run

Cloud Run runs your container image and handles everything else: servers, scaling, HTTPS, and load balancing. You hand it an image, and it hands you a URL.

Services and revisions

• A service is the long-lived thing you deploy to. It has a stable URL. Service names can be up to 49 characters and must be unique per region and project.
• Every deployment creates a new revision: an immutable snapshot of the image and its settings. When you deploy from an image tag, Cloud Run resolves the tag to a digest, so the revision always serves exactly that build.

By default, traffic moves to the newest revision as soon as it is healthy. Because old revisions still exist, rolling back means sending traffic back to one. You can also split traffic between revisions for canary releases.

Deploying

gcloud services enable run.googleapis.com

gcloud run deploy hello \
  --image=us-docker.pkg.dev/cloudrun/container/hello \
  --region=us-central1 \
  --allow-unauthenticated

Leave out --image and pass --source=. instead, and Cloud Run builds the container from your source code for you.

Who can call it

Cloud Run services are private by default. Callers need the Cloud Run Invoker role (roles/run.invoker). --allow-unauthenticated grants that role to the special principal allUsers, which makes the service a public website or API. Use it for public endpoints only. Service-to-service calls should stay private and use service account identity.

Scaling, including to zero

Cloud Run adds container instances as requests arrive and removes them as traffic drops, all the way to zero when nothing is calling. With the default request-based billing, an idle service costs nothing for compute. The trade-off is a cold start: the first request after a quiet period waits for an instance to boot. Setting a minimum number of instances keeps some warm, for a cost.

A container contract to remember

• Listen for HTTP on the port in the PORT environment variable (8080 by default).
• Be stateless. Instances come and go, so keep state in Cloud Storage, a database, or a cache, never on local disk.
• Run as a dedicated service account with only the roles the code needs, as the IAM lesson describes.

Try it

gcloud run deploy hello --image=us-docker.pkg.dev/cloudrun/container/hello --region=us-central1 --allow-unauthenticated
gcloud run services list
gcloud run services describe hello --region=us-central1
gcloud run deploy hello --image=us-docker.pkg.dev/cloudrun/container/hello --region=us-central1

The second deploy creates revision 00002 and moves all traffic to it.

When you're ready, hit Mark complete and move to the next lesson.

Further reading

• Deploying container images to Cloud Run (opens in a new tab) - services, revisions, and every deploy option.
• Cloud Run container runtime contract (opens in a new tab) - the rules your container must follow.