An infrastructure team is deploying a containerized microservice to Google Cloud Run in the `us-central1` region using the `gcloud` CLI. The container is configured internally to listen on port `3000` rather than the default port `8080`, and the service must be restricted so that unauthenticated public requests are rejected. Which TWO flags must be included in the `gcloud run deploy` command to satisfy these operational requirements? (Select TWO.)
- Specify the flag --port 3000 to instruct Cloud Run to route incoming traffic to the container's listening port.Answer
- Specify the flag --no-allow-unauthenticated to enforce IAM authentication on the deployed service.Answer
- CSpecify the flag --set-env-vars PORT=8080 to force the containerized application to remap port 3000 to port 8080.
- DGrant the primitive Owner role (roles/owner) to all project users to permit authenticated invocations.
Answer
To deploy a container listening on port 3000 and block unauthenticated access, the deployment command must include both the flag to specify port 3000 and the flag to disable unauthenticated invocations.
When deploying a containerized workload to Cloud Run that listens on a non-standard port, specifying the container ingress port flag informs Cloud Run where to direct incoming HTTP traffic. Combining this with the flag to require authentication enforces least-privilege security by ensuring only authorized IAM principals can invoke the microservice.
Step-by-Step Solution
Key Concept
Deploying containerized workloads to Cloud Run with custom port configurations and IAM invocation controls.