Deploying Scalable Containerized Web Services on Google Cloud Run with Custom Domains

Introduction

Google Cloud Run has emerged as one of the premier serverless compute platforms in modern cloud engineering. By abstracting container orchestration while maintaining full Docker compatibility, Cloud Run enables developers to run arbitrary stateless microservices written in any programming language, automatically scaling from zero instances during lulls to thousands of instances during viral traffic spikes.

Why Choose Cloud Run Over Traditional VMs & GKE?

• Scale to Zero: Pay only for compute during active request processing down to 100-millisecond billing granularity.
• Fast Cold Starts: Second-generation execution environments launch lightweight containers in under 800 milliseconds.
• Integrated SSL & Domains: Automated managed TLS certificates for custom corporate domains.
• Zero Kubernetes Overhead: Gain container orchestration benefits without maintaining master nodes, etcd clusters, or complex Helm charts.

Step 1: Containerizing Your Application with Docker

A multi-stage Dockerfile ensures minimal image size, faster deployments, and reduced attack surface:

# Multi-stage Dockerfile for Node.js Production Web Service
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=8080
COPY --from=builder /app/package*.json ./
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/out ./out
COPY --from=builder /app/server.js ./server.js

USER node
EXPOSE 8080
CMD ["node", "server.js"]

Step 2: Building & Deploying via Google Cloud CLI

Build your container image using Google Cloud Build and deploy directly to Cloud Run:

# 1. Set default project and region
gcloud config set project your-gcp-project-id
gcloud config set run/region us-central1

# 2. Build and push image to Artifact Registry
gcloud builds submit --tag us-central1-docker.pkg.dev/your-gcp-project-id/cloud-run-apps/web-service:v1

# 3. Deploy to Cloud Run
gcloud run deploy web-service \
  --image us-central1-docker.pkg.dev/your-gcp-project-id/cloud-run-apps/web-service:v1 \
  --platform managed \
  --allow-unauthenticated \
  --min-instances 0 \
  --max-instances 50 \
  --memory 512Mi \
  --cpu 1 \
  --timeout 60s

Step 3: Managing Secrets with Google Secret Manager

Never hardcode API keys or database passwords into environment variables or container images. Mount secrets directly from Google Secret Manager:

gcloud run services update web-service \
  --set-secrets=DATABASE_URL=prod-db-connection-string:latest,GEMINI_API_KEY=gemini-key:latest

Step 4: Mapping Custom Domains with Managed SSL

1. In Cloud Console, navigate to Cloud Run > Custom Domains > Add Mapping.
2. Select your service and enter your verified domain (e.g., api.yourcompany.com).
3. Copy the provided DNS records (CNAME or A/AAAA records) into your DNS provider (Cloudflare, Google Domains, Route53).
4. Google Cloud automatically provisions and renews managed Let's Encrypt TLS certificates.