Deploying a Spring Boot Application to Google Cloud Run

Deploying a Spring Boot application to Cloud Run follows three steps: build a container image, push it to Artifact Registry, and deploy with a single gcloud command. Cloud Run handles the rest — load balancing, TLS, and scaling.

Build the container image

• Option 1: standard Dockerfile with docker build; use a multi-stage build with a JDK build stage and JRE runtime stage to minimize the final image size
• Option 2: Jib (Google's Java container builder) creates an optimized Docker image without a Dockerfile — mvn compile jib:build pushes directly to Artifact Registry with layered image caching, which means subsequent builds push only changed layers; no Docker daemon required in CI

Push to Artifact Registry

• gcloud auth configure-docker REGION-docker.pkg.dev configures Docker to authenticate to Artifact Registry; images are stored in the same region as Cloud Run, eliminating cross-region transfer
• Tag the image with the Git commit SHA: REGION-docker.pkg.dev/PROJECT/REPO/service:SHA — every deployed version is traceable to a commit

Deploy to Cloud Run

• gcloud run deploy my-service --image REGION-docker.pkg.dev/PROJECT/REPO/service:SHA --region us-central1 --platform managed deploys the image; Cloud Run exposes a HTTPS endpoint automatically with a managed TLS certificate
• Configure minimum instances with --min-instances 1 to avoid cold starts for latency-sensitive services; --max-instances N caps scaling; --concurrency sets how many requests one instance handles simultaneously (default 80 for Spring Boot)

Environment and secrets

• Pass environment variables with --set-env-vars; for secrets: --set-secrets DB_PASSWORD=my-secret:latest mounts a Secret Manager secret as an environment variable — which means the password is never in the deployment command or source code
• Cloud Run uses the service's service account to access Secret Manager; assign the Secret Manager Secret Accessor role to the service account