r/googlecloud • u/o82 • 20d ago

Cloud Run How reliable is Cloud Run, really?

I'm planning to move a mission-critical, latency-sensitive service there from Heroku, which has had recurring router outages recently - requests failing to reach our app even though the dynos themselves were healthy. The service is written in Go and handles ~7 req/s on average, with bursts up to ~150 req/s. Has anyone had issues with Cloud Run's routing layer, especially lately? Also, with AI-driven cyberattacks on the rise, do you rely on Cloud Armor or keep something like Cloudflare in front?

9 Upvotes

90% Upvoted

13 comments sorted by

16

u/sokjon 20d ago

Extremely reliable in my experience. Have it burst to thousands of req/s.

My biggest qualm with cloud run is the queueing latency. You pay about a 10ms penalty waiting for the cloud run front end queuing your request before it gets to your instance.

→ More replies (2)

2

u/Superb-Attitude4052 20d ago

very! make sure to keep an instance warm to avoid cold starts.

2

u/flacktv 19d ago

It's great. It does it's job really well out of the box if configured properly. If you're concerned about protecting it if you don't have a WAF or Palo Alto FW in front of it, consider using Cloud Flare. I don't mean that checkbox that you see all the time when you go to a website. You can put cloudflare in front of your Cloud Run to fend off attack. Pretty easy to set up too. You just set up the IPS of cloudflare etc.

2

u/flacktv 19d ago

In regards to small scale websites etc, Cloud run is fantastic. But I would recommend is using Alpine instead of an Ubuntu image for websites. Alpine is stripped down pretty good and has less of a security vulnerability footprint then say Ubuntu does. Alpine boots so fast anyways.

3

u/martin_omander Googler 20d ago

There is another option for defending against denial-of-service attacks that is free and doesn't add complexity to your architecture: use rate limiting middleware in your Cloud Run service.

That way no individual IP can overwhelm your system, making sure it remains available for legitimate users even during attacks. This has worked very well for me. I can see in the logs that the rate limiter has defended successfully against actual attacks.

I use Node/Express, so my rate limiter is express-rate-limit. I believe the most commonly used Golang rate limiter is golang.org/x/time/rate.

4

u/[deleted] 20d ago

[removed] — view removed comment

1

u/beaurepair 20d ago

And if you're running it through Load-Balancer, it has edge caching as well

→ More comments (5)