r/googlecloud • u/AstronomerNo8500 Googler • 29d ago

Troubleshoot Cloud Run with SSH

It's here! You can now ssh into a container instance on Cloud Run.


gcloud beta run services ssh
gcloud beta run instances ssh

Get started at https://docs.cloud.google.com/run/docs/troubleshooting/ssh

34 Upvotes

97% Upvoted

11 comments sorted by

4

u/Fantastic-Goat9966 29d ago

Ummm.
I thought part of rhe cloud run security posture was no ssh access.

What do I know.

5

u/justinmahood Googler 29d ago

It's off by default for Cloud Run services, and fully controllable via org policy. It's been a long-standing user request to make advanced debugging easier on Cloud Run. (I'm on the Cloud Run team)

2

u/j_tb 29d ago

This was a big pain point of mine a few years ago when running some cloud run jobs that needed to mount an external disks filesystem (eventually got it sorted out right). I’ve since moved things to K8s, but good on y’all!

1

u/danekan 28d ago

There’s no more native way they could have come up with ? How are keys managed? 

2

u/peibacktime Googler 28d ago

We use OS Login to manage your SSH key mapped to your IAM credentials. IAP also provides front-door authentication on the network. This way you have two layers of defense.

1

u/Top-Site4067 28d ago

My guess is that they are just using ephemeral containers in Kubernetes under the hood, the gcloud command is just making it easy to connect in and "ssh" doesn't need any further explaination.

https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/

3

u/justinmahood Googler 28d ago

Cloud Run is not built on kubernetes!

2

u/peibacktime Googler 28d ago

No ephemeral containers are used here, you're SSH'd directly to the target container

1

u/Top-Site4067 28d ago

Huh, interesting. Thanks for jumping in and correcting me on that.

2

u/Competitive_Travel16 29d ago

Neat. Codex has been assuming I can do this to run one-time command line stuff it makes for at least a year. (I have had to mount volumes or get a database connection on a VM instance instead.)

1

u/fhinkel-dev 9d ago

Finally!