GCP for DevOps — Cloud Run Serverless

Cloud Run Serverless

While Cloud Run was covered in the Containers chapter, this page focuses on serverless patterns — scale-to-zero, event-driven processing, microservices, and cost-optimized configurations.

Scale-to-Zero Pattern

# Deploy with scale-to-zero (default)
$ gcloud run deploy event-processor \
    --image=us-central1-docker.pkg.dev/my-project/my-repo/processor:v1.0.0 \
    --region=us-central1 \
    --min-instances=0 \
    --max-instances=50 \
    --concurrency=1 \
    --cpu-throttling

# Cost: $0 when no traffic
# First request: ~1-2s cold start

Always-On Pattern (Low Latency)

# Keep instances warm for latency-sensitive APIs
$ gcloud run deploy api \
    --image=us-central1-docker.pkg.dev/my-project/my-repo/api:v1.0.0 \
    --region=us-central1 \
    --min-instances=2 \
    --max-instances=100 \
    --concurrency=80 \
    --no-cpu-throttling \
    --cpu-boost

Cloud Run as Pub/Sub Subscriber

# Create a Pub/Sub push subscription to Cloud Run
$ gcloud pubsub subscriptions create process-orders-sub \
    --topic=orders \
    --push-endpoint=https://order-processor-abc123-uc.a.run.app/process \
    --push-auth-service-account=pubsub-invoker@my-project.iam.gserviceaccount.com

Cloud Run with Eventarc

# Trigger Cloud Run from Cloud Storage events
$ gcloud eventarc triggers create upload-trigger \
    --location=us-central1 \
    --destination-run-service=image-processor \
    --destination-run-region=us-central1 \
    --event-filters="type=google.cloud.storage.object.v1.finalized" \
    --event-filters="bucket=my-uploads" \
    --service-account=eventarc-sa@my-project.iam.gserviceaccount.com

# Trigger Cloud Run from Firestore changes
$ gcloud eventarc triggers create db-change-trigger \
    --location=us-central1 \
    --destination-run-service=db-processor \
    --destination-run-region=us-central1 \
    --event-filters="type=google.cloud.firestore.document.v1.written" \
    --event-filters="database=(default)" \
    --event-filters-path-pattern="document=users/{userId}" \
    --service-account=eventarc-sa@my-project.iam.gserviceaccount.com

Microservices on Cloud Run

┌──────────────────────────────────────────────────┐
│         Microservices on Cloud Run                │
├──────────────────────────────────────────────────┤
│                                                   │
│  Client → LB → API Gateway                       │
│                    │                              │
│           ┌────────┼────────┐                     │
│           ▼        ▼        ▼                     │
│     ┌─────────┐ ┌──────┐ ┌──────────┐           │
│     │ Users   │ │Orders│ │Inventory │           │
│     │ Service │ │Svc   │ │Service   │           │
│     └────┬────┘ └──┬───┘ └────┬─────┘           │
│          │         │          │                   │
│          ▼         ▼          ▼                   │
│     Firestore  Cloud SQL  Firestore              │
│                                                   │
│  Each service: independent deploy, scale, version │
└──────────────────────────────────────────────────┘

Service-to-Service Authentication

# Internal services should NOT allow unauthenticated access
$ gcloud run deploy internal-api \
    --image=us-central1-docker.pkg.dev/my-project/my-repo/internal:v1.0.0 \
    --region=us-central1 \
    --no-allow-unauthenticated

# Grant invoker role to calling service's SA
$ gcloud run services add-iam-policy-binding internal-api \
    --region=us-central1 \
    --member="serviceAccount:frontend-sa@my-project.iam.gserviceaccount.com" \
    --role="roles/run.invoker"

Cloud Run vs Cloud Functions

Feature	Cloud Run	Cloud Functions
Packaging	Docker container	Source code
Languages	Any	Node, Python, Go, Java, .NET, Ruby, PHP
Concurrency	Up to 1000/instance	Up to 1000/instance (Gen 2)
Startup	Seconds	Seconds
Max timeout	60 min	60 min (Gen 2)
Customization	Full container control	Limited to runtime
Webhooks	Yes	Yes
Background tasks	Jobs	Event triggers

Rule of thumb: Use Cloud Functions for simple event handlers; use Cloud Run for everything else.

Common Mistakes

Mistake	Why It’s Wrong	Fix
CPU throttling on latency-sensitive	CPU paused between requests	Use --no-cpu-throttling
Concurrency=1 for web servers	Too many instances, high cost	Set concurrency to 80+
No authentication between services	Security risk	Use IAM + service accounts
Large container images	Slow cold starts	Use distroless/alpine images
Not using Cloud Run Jobs for batch	Services stay running	Use Jobs for run-to-completion

Quick Reference

Pattern	Config
Scale-to-zero	--min-instances=0 --cpu-throttling
Always-on	--min-instances=2 --no-cpu-throttling
Event-driven	Eventarc trigger → Cloud Run
Pub/Sub consumer	Push subscription → Cloud Run
Batch processing	Cloud Run Jobs

Next → API Gateway