Configure environment variables

When you set environment variables, they are injected into the container and are accessible to your code. Environment variables are set as key/value pairs.

Caution: You should not use environment variables to store and consume secrets, because environment variables are visible to anyone with project Viewer permissions or greater. Instead, use Secret Manager with Cloud Run as described in the Using secrets page.

Reserved names

The environment variables defined in the container runtime contract are reserved and cannot be set. In particular, the PORT environment variable is injected inside your container by Cloud Run. You should not set it yourself.

Required roles

To get the permissions that you need to configure Cloud Run jobs, ask your administrator to grant you the following IAM roles:

• Cloud Run Developer (roles/run.developer) on the Cloud Run job
• Service Account User (roles/iam.serviceAccountUser) on the service identity

For a list of IAM roles and permissions that are associated with Cloud Run, see Cloud Run IAM roles and Cloud Run IAM permissions. If your Cloud Run job interfaces with Google Cloud APIs, such as Cloud Client Libraries, see the service identity configuration guide. For more information about granting roles, see deployment permissions and manage access.

Warning: If your Cloud Run job uses service identity to authenticate access to Google Cloud APIs, never set GOOGLE_APPLICATION_CREDENTIALS as an environment variable on a Cloud Run job. Always configure a user-managed service account instead.

Set environment variables

To set an environment variable for a Cloud Run job:

Console

1. In the Google Cloud console, go to the Cloud Run jobs page:

   Go to Cloud Run

2. If you are configuring a new job, click the Jobs tab and fill out the initial job settings page as desired. If you are configuring an existing job, click the job, then click Edit.

3. Click Container, variables and secrets, connections, security to expand the job properties page.

4. Click the Variables tab.

   

   • Do the following:
     • If you are adding a variable, click Add Variable, and specify the name you want for the variable and its value in the Name and Value text boxes.
     • If you are changing a value for a variable, replace the current value in the Value text box with the one you want.
     • If you are removing one or more environment variables, hover your cursor to the left of the Value textbox of the variable you are removing to display the Trash icon, and click it.

5. Click Create or Update.

Command line

Set, update, or remove environment variables of an existing service, using the gcloud run jobs update command. You can use any of the following flags, as needed:

• --set-env-vars
• --update-env-vars
• --remove-env-vars

• --clear-env-vars

  You can specify environment variables while creating a job or when updating a job:

  gcloud run jobs create JOB_NAME --image IMAGE_URL --update-env-vars KEY1=VALUE1,KEY2=VALUE2
  
  gcloud run jobs update JOB_NAME --update-env-vars KEY1=VALUE1,KEY2=VALUE2

• Replace JOB_NAME with the name of your job.

• Replace KEY1=VALUE1,KEY2=VALUE2, with the comma separated list of desired variable names and their values.

• Replace IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/job:latest.

YAML

Download and view existing job configuration using the gcloud run jobs describe --format export command, which yields cleaned results in YAML format. Then modify the fields described below and upload the modified YAML using the gcloud run jobs replace command. Make sure you only modify fields as documented.

1. To view and download the configuration:

   gcloud run jobs describe JOB_NAME --format export > job.yaml

2. 1. Update the name and value attributes under env as shown under containers::

   apiVersion: run.googleapis.com/v1
   kind: Job
   metadata:
     name: JOB
   spec:
     template:
       spec:
         template:
           spec:
             containers:
             - image: IMAGE
               env:
               - name: KEY-1
                 value: VALUE-1
               - name: KEY-N
                 value: VALUE-N

   Replace KEY-1, VALUE-1 with the environment variable and value. Optionally add more variables and values as desired.

   You can also specify more configuration such as environment variables or memory limits.

3. Update the existing job configuration:

   gcloud run jobs replace job.yaml

Set many environment variables

If you have too many environment variables that cannot be easily listed in KEY1=VALUE1,KEY2=VALUE2 format, you can alternatively repeat the flags listed above multiple times:

   [...]
   --set-env-vars "KEY1=VALUE1" \
   --set-env-vars "KEY2=VALUE2" \
   --set-env-vars "KEY3=VALUE3"

Escape comma characters

Because the comma character , is used to split environment variables, if your environment variable contains comma characters as values, you need to escape those delimiters by specifying a different delimiter character, for example, @:

--set-env-vars "^@^KEY1=value1,value2,value3@KEY2=..."

Set default environment variables in the container

You can use the ENV statement in a Dockerfile to set default values for environment variables:

ENV KEY1=VALUE1,KEY2=VALUE2

Order of precedence: container vs service or job variables

If you set a default environment variable in the container and also set an environment variable with the same name on the Cloud Run service or job, the value set on the service takes precedence.

View environment variables settings

To view the current environment variables settings for your Cloud Run job:

Console

1. In the Google Cloud console, go to the Cloud Run jobs page:

   Go to Cloud Run jobs

2. Click the job you are interested in to open the Job details page.

3. Click the Configuration tab.

4. Locate the environment variables setting in the configuration details.

Command line

1. Use the following command:

   gcloud run jobs describe JOB_NAME

2. Locate the environment variables setting in the returned configuration.