Cloud Run: Services, Jobs, Revisions and Traffic

GCP Basics · Containers & Serverless – Cloud Run, Cloud Run Functions, GKE and Cloud Build · Lesson 1 of 5

Cloud Run runs stateless containers that scale from zero; every deploy creates an immutable revision, traffic can be split between revisions, and jobs run containers to completion.

Cloud Run runs any container that listens on a port (services) or runs to completion (jobs). There are no servers or clusters to manage, and services scale to zero when idle.

flowchart LR
  DEV["git push / gcloud run deploy"] --> R1["Revision web-00006<br/>image 1.3.0"]
  DEV --> R2["Revision web-00007<br/>image 1.4.0"]
  U["Users"] --> SVC["Service web<br/>https://web-…run.app"]
  SVC -- "90%" --> R1
  SVC -- "10% canary" --> R2
  %% step DEV: Each deploy creates a new immutable revision with the image, env vars, secrets and settings.
  %% step R1: Revision 00006 runs the current version.
  %% step R2: Revision 00007 runs the new image.
  %% step U: Users call one stable HTTPS URL; Cloud Run handles TLS and load balancing.
  %% step SVC: Traffic is split 90/10 so you can watch the new revision before moving all traffic, or roll back instantly.

Services

Setting	Default / range	Why it matters
Concurrency	80 requests per instance (up to 1000)	Fewer instances for I/O-bound apps
Min / max instances	0 / 100	Min > 0 avoids cold starts; max protects databases
CPU / memory	Up to 8 vCPU, 32 GiB (more with GPUs)	Per instance
Billing	Request-based (CPU only during requests) or instance-based	Instance-based for background work
Request timeout	5 min default, up to 60 min	Long requests
Ingress	all, internal, internal + Cloud Load Balancing	Hide services from the Internet
Authentication	`--no-allow-unauthenticated` + `roles/run.invoker`	Private services and service-to-service calls

Give each service its own service account (--service-account), read secrets with --set-secrets=DB_PASS=db-password:latest, and reach private IPs with Direct VPC egress (--network, --subnet).

Revisions and traffic

Revisions are immutable; roll back by sending traffic to an older one.
Deploy with --no-traffic --tag=green to get a private test URL (https://green---web-….run.app) before shifting traffic.
gcloud run services update-traffic web --to-revisions=web-00007-xyz=10 sends 10% to the new revision; --to-latest sends 100%.

Jobs

Cloud Run jobs run tasks to completion: database migrations, nightly reports, batch processing. Set tasks (parallel copies, each gets CLOUD_RUN_TASK_INDEX), parallelism, max retries and task timeout. Trigger with gcloud run jobs execute or Cloud Scheduler.

gcloud run deploy web --image=asia-southeast1-docker.pkg.dev/dl-lab-dev/shop/web:1.4.0 \
  --region=asia-southeast1 --no-allow-unauthenticated \
  --service-account=web-sa@dl-lab-dev.iam.gserviceaccount.com --min-instances=1
gcloud run jobs create nightly-report --image=asia-southeast1-docker.pkg.dev/dl-lab-dev/shop/report:2.0 \
  --region=asia-southeast1 --tasks=10 --max-retries=3

Command	Meaning
`gcloud run revisions list --service=web --region=…`	Revisions
`gcloud run services describe web --region=… --format="value(status.url)"`	Service URL
`gcloud run jobs execute nightly-report --region=…`	Run a job now

Traps: containers must listen on $PORT (8080 by default) and keep no state on local disk; background threads get no CPU outside requests with request-based billing; --allow-unauthenticated makes the service public.