Docker

To test your container image locally using Docker:

1. Use the Docker command:

   PORT=8080&&dockerrun-p9090:${PORT}-ePORT=${PORT}IMAGE_URL

   ReplaceIMAGE_URL with a reference to the container image, forexample,us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry,therepositoryREPO_NAME mustalready be created. The URL follows the format ofLOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG.

   ThePORT environment variable specifies the port your application willuse to listen for HTTP or HTTPS requests. This is a requirement from theContainer runtime contract. Inthis example, we use port 8080.

   Caution: Using the default service account:

   If you rely on thedefault serviceaccountwhen deploying to Cloud Run, be aware that it is not available locally, so youneed a service account along with a public/private key-pair savedlocally in order to run that image locally with Docker. For more info, seethe next tabDocker with Google Cloudaccess.

2. Openhttp://localhost:9090 in your browser.

If you are new to working with containers, you may want to review theDocker Getting Started guide. To learnmore about Docker commands, refer to theDocker documentation.

Docker with Google Cloud Access

If you are using Google Cloud client libraries to integrate yourapplication with Google Cloud services, and have not yet secured thoseservices to control external access, you can set up your local container toauthenticate with Google Cloud services usingApplication Default Credentials.

To run locally:

1. Refer to the instructions forsetting up a service account key.

   Note: Service account keys are a security risk if not managed correctly. You should choose a more secure alternative to service account keyswhenever possible. If you must authenticate with a service account key, you are responsible for thesecurity of the private key and for other operations described by Best practices for managing service account keys.If you are prevented from creating a service account key, service account key creation mightbe disabled for your organization. For more information, see Managing secure-by-default organization resources.

   If you acquired the service account key from an external source, you must validate it before use.For more information, see Security requirements for externally sourced credentials.

2. The following Docker run flags inject the credentials and configuration fromyour local system into the local container:

   1. Use the--volume (-v) flag to inject the credential file into the container(assumes you have already set yourGOOGLE_APPLICATION_CREDENTIALS environment variable on your machine):

      -v$GOOGLE_APPLICATION_CREDENTIALS:/tmp/keys/FILE_NAME.json:ro

   2. Use the--environment (-e) flag to set theGOOGLE_APPLICATION_CREDENTIALS variableinside the container:

      -eGOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/FILE_NAME.json

3. Optionally, use this fully configured Dockerrun command:

   PORT=8080&&dockerrun\-p9090:${PORT}\-ePORT=${PORT}\-eK_SERVICE=dev\-eK_CONFIGURATION=dev\-eK_REVISION=dev-00001\-eGOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/FILE_NAME.json\-v$GOOGLE_APPLICATION_CREDENTIALS:/tmp/keys/FILE_NAME.json:ro\IMAGE_URL

   Note that the path

   /tmp/keys/FILE_NAME.json

   shown in theexample above is a reasonable location to place your credentials inside the container.

   However, other directory locations will also work. The crucial requirementis that theGOOGLE_APPLICATION_CREDENTIALS environment variable mustmatch the bind mount location inside the container.

   Note also, that with some Google Cloud services, you may want to use an alternateconfiguration to isolate local troubleshooting from production performanceand data.

Cloud Code emulator

TheCloud Code plugin forVS Code andJetBrains IDEslets you locally run and debug your container image in a Cloud Runemulator within your IDE. The emulator allows you configure an environment that isrepresentative of your service running on Cloud Run.

You can configure properties like CPU and memory allocation,specify environment variables, and set Cloud SQLdatabase connections.

1. Install Cloud Code forVS Code or aJetBrains IDE.
2. Follow the instructions for locally developing and debugging within your IDE.
3. VS Code: Locallydeveloping anddebugging
4. IntelliJ: Locallydeveloping anddebugging

gcloud CLI

Google Cloud CLI contains alocal development environment for emulatingCloud Run that can build a container from source, run the containeron your local machine, and automatically rebuild the container upon sourcecode changes.

To start the local development environment:

1. Change directory to the directory containing the source code of your service.

2. Invoke the command:

   gcloudbetacodedev

   If a Dockerfile is present in the local directory, it is used to buildthe container. If no Dockerfile is present, the container is builtwithGoogle Cloud's buildpacks.

To see your service running, visit http://localhost:8080/ in your browser.If you specified a custom port with the--local-port option, remember toopen your browser to that port.

To stop the local server:

• Mac OS and Linux: Control-C
• Windows: Control-Break

Customize the service configuration

You can customize the Cloud Run configuration of the service runninglocally using a YAML file. The YAML format is the same that can be usedto deploy aCloud Run service, but onlysupports a subset of the Cloud Run service settings.gcloud betacode dev looks for and uses any file ending in*.service.dev.yaml inthe current directory. If none are found, it will use any file ending with*.service.yaml.

You can configure the following settings for local development:

• Environment variables
• Container memory limits
• Container CPU limits
• Service name
• Service accounts

The containerimage field is not required for local development, because the imageis built and provided to the service when the command is run.

You can use the following exampleservice.dev.yaml file for local development:

apiVersion:serving.knative.dev/v1kind:Servicemetadata:name:my-service-namespec:template:spec:containers:-env:-name:FOOvalue:bar

Test using credentials

To give permission to the container to use Google Cloud services, you must give the container an access credential.

• To give the container access to a credential using your own account, login using gcloud and use the--application-default-credential flag:

  gcloudauthapplication-defaultlogingcloudbetacodedev--dockerfile=PATH_TO_DOCKERFILE--application-default-credential

• To give the application credentials as a service account, use the--service-account flag:

  gcloudbetacodedev--dockerfile=PATH_TO_DOCKERFILE--service-account=SERVICE_ACCOUNT_EMAIL

  Note: The--service-account flagcauses a service account key to be downloadedand cached locally.Service account keys are a security risk if not managed correctly. You should choose a more secure alternative to service account keyswhenever possible. If you must authenticate with a service account key, you are responsible for thesecurity of the private key and for other operations described by Best practices for managing service account keys.If you are prevented from creating a service account key, service account key creation mightbe disabled for your organization. For more information, see Managing secure-by-default organization resources.

  If you acquired the service account key from an external source, you must validate it before use.For more information, see Security requirements for externally sourced credentials.

Docker

To confirm you are running your code locally on Google Cloud CLI you canattempt to query theK_REVISION environment variable but as it has not beenset no value will be present.

Docker with Google Cloud Access

If you used the exact values from the above section in Step 3 to confirm youare running your code locally on Google Cloud CLI you can query theK_REVISION environment variable and look for the valuedev-00001 toconfirm it is running locally.

Cloud Code emulator

To confirm you are running your code locally on Cloud Code you canquery theK_REVISION environment variable and look for a value oflocalto confirm it is running locally.

gcloud CLI

To confirm you are running your code locally on Google Cloud CLI you canquery theK_REVISION environment variable and look for a value that beginswithdev- to confirm it is running locally.