This page describes how to deploy container images to a new Cloud Run service or to a new revision of an existing Cloud Run service.
The container image is imported by Cloud Run when deployed. Cloud Run keeps this copy of the container image as long as it is used by a serving revision. Container images are not pulled from their container repository when a new Cloud Run instance is started.
For an example walkthrough of deploying a new service, see Deploy a sample container quickstart.
Before you start
If you are under a domain restriction organization policy restricting unauthenticated invocations for your project, you will need to access your deployed service as described under Testing private services.
Required roles
To get the permissions that you need to deploy Cloud Run services, ask your administrator to grant you the following IAM roles:
- Cloud Run Developer (
roles/run.developer) on the Cloud Run service - Service Account User (
roles/iam.serviceAccountUser) on the service identity - Artifact Registry Reader (
roles/artifactregistry.reader) on the Artifact Registry repository of the deployed container image - If you are using a cross-project service account to deploy a service: Service Account Token Creator (