SOP-001: Deploy Container to Cloud Run

DOCUMENT CONTROL

Field	Value
SOP ID	SOP-001
Version	1.0
Status	Active

Purpose

Deploy a pre-built container image to Google Cloud Run. This SOP covers deploying from Google Container Registry (GCR), Artifact Registry, or Docker Hub.

Prerequisites

• Google Cloud account with billing enabled
• gcloud CLI installed and authenticated
• Container image pushed to a registry
• IAM permissions: roles/run.admin

Flowchart

┌─────────────────┐
│  Authenticate   │
│   with gcloud   │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Select/Create  │
│     Project     │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Enable Cloud   │
│    Run API      │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│ Deploy Service  │
│  with gcloud    │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│ Verify & Test   │
│   Service URL   │
└─────────────────┘

Procedure

Step 1: Authenticate with Google Cloud

# Login to your Google account
gcloud auth login

# Set your project
gcloud config set project YOUR_PROJECT_ID

Step 2: Enable Cloud Run API

gcloud services enable run.googleapis.com

Step 3: Deploy the Container

Basic Deploy

gcloud run deploy my-service \
  --image gcr.io/YOUR_PROJECT/YOUR_IMAGE:latest \
  --region us-central1 \
  --allow-unauthenticated

With Environment Variables

gcloud run deploy my-service \
  --image gcr.io/YOUR_PROJECT/YOUR_IMAGE:latest \
  --region us-central1 \
  --set-env-vars "DATABASE_URL=postgres://...,API_KEY=xxx" \
  --allow-unauthenticated

With Resource Limits

gcloud run deploy my-service \
  --image gcr.io/YOUR_PROJECT/YOUR_IMAGE:latest \
  --region us-central1 \
  --memory 2Gi \
  --cpu 2 \
  --timeout 300 \
  --concurrency 80 \
  --allow-unauthenticated

Step 4: Verify Deployment

# Get service URL
gcloud run services describe my-service --region us-central1 --format 'value(status.url)'

# Test the endpoint
curl $(gcloud run services describe my-service --region us-central1 --format 'value(status.url)')

AUTHENTICATION

Using --allow-unauthenticated makes your service public. For internal services, omit this flag and use IAM authentication.

Verification Checklist

• [ ] Service appears in Cloud Run console
• [ ] Service URL returns expected response
• [ ] Logs show successful startup in Cloud Logging
• [ ] Metrics visible in Cloud Monitoring
• [ ] Revision shows "100% traffic"

Common Options

Flag	Description	Default
--memory	Memory limit (128Mi-32Gi)	512Mi
--cpu	CPU limit (1-8)	1
--timeout	Request timeout (1-3600s)	300
--concurrency	Max concurrent requests per instance	80
--min-instances	Minimum instances (0 = scale to zero)	0
--max-instances	Maximum instances	100

Rollback

# List revisions
gcloud run revisions list --service my-service --region us-central1

# Route traffic to previous revision
gcloud run services update-traffic my-service \
  --region us-central1 \
  --to-revisions PREVIOUS_REVISION=100