Cloud Run

# Deploy from source (auto-builds with Buildpacks)
gcloud run deploy my-service \
  --source . \
  --region=us-central1 \
  --allow-unauthenticated

# Deploy a pre-built image from Artifact Registry (gcr.io is shut down; use *-docker.pkg.dev)
gcloud run deploy my-service \
  --image=us-central1-docker.pkg.dev/my-project/my-repo/my-app:latest \
  --region=us-central1 \
  --allow-unauthenticated

# Deploy with resource limits + env vars
gcloud run deploy my-service \
  --image=us-central1-docker.pkg.dev/my-project/my-repo/my-app:latest \
  --region=us-central1 \
  --cpu=2 \
  --memory=1Gi \
  --concurrency=80 \
  --min-instances=1 \
  --max-instances=100 \
  --set-env-vars="NODE_ENV=production,PORT=8080" \
  --allow-unauthenticated

# List services
gcloud run services list --region=us-central1

# Describe a service (URL, latest revision, traffic)
gcloud run services describe my-service --region=us-central1

# Get the service URL
gcloud run services describe my-service \
  --region=us-central1 \
  --format="value(status.url)"

# Delete a service
gcloud run services delete my-service --region=us-central1

# List revisions
gcloud run revisions list --service=my-service --region=us-central1

# Split traffic (canary: 10% to new revision)
gcloud run services update-traffic my-service \
  --region=us-central1 \
  --to-revisions=my-service-00005-abc=10,LATEST=90

# Route 100% to latest
gcloud run services update-traffic my-service \
  --region=us-central1 \
  --to-latest

# Delete an old revision
gcloud run revisions delete my-service-00002-xyz --region=us-central1

# Set env vars
gcloud run services update my-service \
  --region=us-central1 \
  --set-env-vars="DB_HOST=10.0.0.1,DB_NAME=prod"

# Remove an env var
gcloud run services update my-service \
  --region=us-central1 \
  --remove-env-vars="OLD_VAR"

# Mount a Secret Manager secret as env var
gcloud run services update my-service \
  --region=us-central1 \
  --set-secrets="DB_PASSWORD=db-password:latest"

# Mount secret as a volume file
gcloud run services update my-service \
  --region=us-central1 \
  --set-secrets="/secrets/config.json=app-config:latest"

# CPU always-on (for background processing, WebSockets)
gcloud run services update my-service \
  --region=us-central1 \
  --no-cpu-throttling \
  --min-instances=1

# Require authentication (private service)
gcloud run services update my-service \
  --region=us-central1 \
  --no-allow-unauthenticated

# Grant a specific account permission to invoke
gcloud run services add-iam-policy-binding my-service \
  --region=us-central1 \
  --member=user:alice@example.com \
  --role=roles/run.invoker

# Grant a service account permission (service-to-service)
gcloud run services add-iam-policy-binding my-service \
  --region=us-central1 \
  --member=serviceAccount:caller-sa@proj.iam.gserviceaccount.com \
  --role=roles/run.invoker

# Connect to a VPC (for Cloud SQL, Memorystore, etc.)
gcloud run services update my-service \
  --region=us-central1 \
  --vpc-connector=my-connector \
  --vpc-egress=all-traffic          # or private-ranges-only

# Create a Serverless VPC Access connector first
gcloud compute networks vpc-access connectors create my-connector \
  --region=us-central1 \
  --subnet=my-subnet

# Create a job (for batch / one-off tasks)
gcloud run jobs create my-job \
  --image=us-central1-docker.pkg.dev/my-project/my-repo/my-job:latest \
  --region=us-central1 \
  --tasks=10 \
  --max-retries=3

# Execute a job
gcloud run jobs execute my-job --region=us-central1

# Execute and wait for completion
gcloud run jobs execute my-job --region=us-central1 --wait

# Schedule a job with Cloud Scheduler
gcloud scheduler jobs create http nightly-job \
  --location=us-central1 \
  --schedule="0 2 * * *" \
  --uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/my-proj/jobs/my-job:run" \
  --oauth-service-account-email=scheduler-sa@proj.iam.gserviceaccount.com

# Tail logs
gcloud logging read "resource.type=cloud_run_revision AND resource.labels.service_name=my-service" \
  --limit=50 --format=json

# Or use the shorthand
gcloud beta run services logs read my-service --region=us-central1 --limit=100

# Stream live logs
gcloud beta run services logs tail my-service --region=us-central1