| name | cloud-run |
| description | Deploy and manage containerized workloads on Cloud Run. Covers service creation, traffic splitting, IAM, VPC connectivity, secrets integration, auto-scaling, and gcloud CLI patterns. Warns before billable deployments. |
| version | 0.1 |
| triggers | ["deploy to cloud run","create cloud run service","cloud run","serverless container","scale cloud run","cloud run IAM","cloud run VPC","cloud run secrets","gcloud run"] |
| required_scopes | ["run.services.create","run.services.delete","run.services.get","run.services.list","run.services.update","run.routes.invoke"] |
| mcp_servers | ["google-cloud-run"] |
Cloud Run
Deploy and manage containerized applications on Google Cloud Run — fully managed, serverless, and scales to zero.
Prerequisites
gcloud CLI authenticated (gcloud auth login or ADC)- Project set:
gcloud config set project PROJECT_ID
- APIs enabled:
gcloud services enable run.googleapis.com
Core Patterns
Deploy a container
gcloud run deploy SERVICE_NAME \
--image IMAGE_URI \
--region REGION \
--platform managed \
--no-allow-unauthenticated
Grant invoker access (least-privilege)
gcloud run services add-iam-policy-binding SERVICE_NAME \
--region REGION \
--member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
--role="roles/run.invoker"
VPC connector (private connectivity)
gcloud run services update SERVICE_NAME \
--vpc-connector CONNECTOR_NAME \
--region REGION
Mount a secret
gcloud run services update SERVICE_NAME \
--set-secrets=/path/to/secret=SECRET_NAME:latest \
--region REGION
Safety Rules
- Never use
--allow-unauthenticated without explicit intent and gcp-security sign-off
- Always specify
--no-allow-unauthenticated as the default
- Cost warning: Cloud Run bills per request and per CPU/memory allocated — estimate before deploying high-traffic services
References
