$npx -y skills add jmxt3/gitscape.ai --skill cloud-run-basicsManages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
| 1 | # Cloud Run Basics |
| 2 | |
| 3 | Cloud Run is a fully managed application platform for running your code, |
| 4 | function, or container on top of Google's highly scalable infrastructure. It |
| 5 | abstracts away infrastructure management, providing three primary resource |
| 6 | types: |
| 7 | |
| 8 | 1. **Services:** Responds to HTTP requests sent to a unique and stable |
| 9 | endpoint, using stateless instances that autoscale based on a variety of key |
| 10 | metrics, also responds to events and functions. |
| 11 | 2. **Jobs:** Executes parallelizable tasks that are executed manually, or on a |
| 12 | schedule, and run to completion. |
| 13 | 3. **Worker pools:** Handles always-on background workloads such as pull-based |
| 14 | workloads, for example, Kafka consumers, Pub/Sub pull queues, or RabbitMQ |
| 15 | consumers. |
| 16 | |
| 17 | ## Prerequisites |
| 18 | |
| 19 | 1. Enable the Cloud Run Admin API and Cloud Build APIs: |
| 20 | |
| 21 | ```bash |
| 22 | gcloud services enable run.googleapis.com cloudbuild.googleapis.com --quiet |
| 23 | ``` |
| 24 | |
| 25 | 1. If you are under a domain restriction organization policy [restricting](https://docs.cloud.google.com/organization-policy/restrict-domains) |
| 26 | unauthenticated invocations for your project, you will need to access your |
| 27 | deployed service as described under [Testing private |
| 28 | services](https://docs.cloud.google.com/run/docs/triggering/https-request#testing-private). |
| 29 | |
| 30 | ### Required roles |
| 31 | |
| 32 | You need the following roles to deploy your Cloud Run resource: |
| 33 | |
| 34 | * Cloud Run Admin (`roles/run.admin`) on the project |
| 35 | * Cloud Run Source Developer (`roles/run.sourceDeveloper`) on the project |
| 36 | * Service Account User (`roles/iam.serviceAccountUser`) on the service |
| 37 | identity |
| 38 | * Logs Viewer (`roles/logging.viewer`) on the project |
| 39 | |
| 40 | Cloud Build automatically uses the Compute Engine default service account as the |
| 41 | default Cloud Build service account to build your source code and Cloud Run |
| 42 | resource, unless you override this behavior. |
| 43 | |
| 44 | For Cloud Build to build your sources, grant the Cloud Build service account the |
| 45 | Cloud Run Builder (`roles/run.builder`) role on your project: |
| 46 | |
| 47 | ```bash |
| 48 | gcloud projects add-iam-policy-binding PROJECT_ID \ |
| 49 | --member=serviceAccount:SERVICE_ACCOUNT_EMAIL_ADDRESS \ |
| 50 | --role=roles/run.builder \ |
| 51 | --quiet |
| 52 | ``` |
| 53 | |
| 54 | Replace `PROJECT_ID` with your Google Cloud project ID and |
| 55 | `SERVICE_ACCOUNT_EMAIL_ADDRESS` with the email address of the Cloud Build |
| 56 | service account. |
| 57 | |
| 58 | ## Deploy a Cloud Run service |
| 59 | |
| 60 | You can deploy your service to Cloud Run by using a container image or deploy |
| 61 | directly from source code using a single Google Cloud CLI command. |
| 62 | |
| 63 | > **CRITICAL RULE:** Any deployed code MUST listen on 0.0.0.0 (not 127.0.0.1) |
| 64 | > and use the injected $PORT environment variable (defaults to 8080), or it will |
| 65 | > crash on boot. |
| 66 | |
| 67 | ### Deploy a container image to Cloud Run |
| 68 | |
| 69 | Cloud Run imports your container image during deployment. Cloud Run keeps this |
| 70 | copy of the container image as long as it is used by a serving revision. |
| 71 | Container images are not pulled from their container repository when a new Cloud |
| 72 | Run instance is started. |
| 73 | |
| 74 | ### Supported container images |
| 75 | |
| 76 | You can directly use container images stored in the [Artifact |
| 77 | Registry](https://docs.cloud.google.com/artifact-registry/docs/overview), or |
| 78 | [Docker Hub](https://hub.docker.com/). Google recommends the use of Artifact |
| 79 | Registry since Docker Hub images are |
| 80 | [cached](https://docs.cloud.google.com/artifact-registry/docs/pull-cached-dockerhub-images) |
| 81 | for up to one hour. |
| 82 | |
| 83 | You can use container images from other public or private registries (like JFrog |
| 84 | Artifactory, Nexus, or GitHub Container Registry), by setting up an [Artifact |
| 85 | Registry remote |
| 86 | repository](https://docs.cloud.google.com/artifact-registry/docs/repositories/remote-repo). |
| 87 | |
| 88 | You should only consider [Docker Hub](https://hub.docker.com/) for deploying |
| 89 | popular container images such as [Docker Official |
| 90 | Images](https://docs.docker.com/docker-hub/official_images/) or [Docker |
| 91 | Sponsored OSS images](https://docs.docker.com/docker-hub/dsos-program/). For |
| 92 | higher availability, Google recommends deploying these Docker Hub images using |
| 93 | an [Artifact Registry remote |
| 94 | repository](https://docs.cloud.google.com/artifact-registry/docs/repositories/remote-repo). |
| 95 | |
| 96 | To deploy a container image, run the following command: |
| 97 | |
| 98 | ```bash |
| 99 | gcloud run deploy SERVICE_NAME \ |
| 100 | --image IMAGE_URL \ |
| 101 | --region us-central1 \ |
| 102 | --allow-unauthenticated \ |
| 103 | --quiet |
| 104 | ``` |
| 105 | |
| 106 | Replace the following: |
| 107 | |
| 108 | * SERVICE_NAME: the name of the service you want to deploy to. Service names |
| 109 | must be 49 characters or less and must be unique per region and project. If |
| 110 | the service does not exist yet, this command creates the service during the |
| 111 | deployment. You can omit this parameter entirely, but you will be prompted |
| 112 | for the s |