Known Issues for Cloud Run

This page lists known issues for Cloud Run.

You can also check for existing issues or open new issues in the public issue trackers.

For help troubleshooting common issues encountered with Cloud Run, see troubleshooting.

Google Cloud services not yet supported

Note: For a list of supported Google Cloud services, refer to Connecting to Google Cloud services.

The following table lists services that are not yet supported by Cloud Run.

Service	Notes
Web Security Scanner
Container Threat Detection

High request latency with custom domains when invoking from some regions

Requests to Cloud Run services using custom domains can have a very high latency from some locations. This issue is more pronounced for Cloud Run services in asia-northeast1 and us-east4. If you observe this issue, you can achieve greater performance with Cloud Load Balancing using a serverless NEG.

HTTP/2 Push is not supported

Cloud Run supports HTTP/2, but not HTTP/2 Server Push.

Using HTTP/2 behind a classic Application Load Balancer secured with Identity-Aware Proxy is not supported

Cloud Run services with HTTP/2 enabled behind a classic Application Load Balancer that are secured with IAP encounter an infinite redirect loop upon request. Google recommends using a global external Application Load Balancer when using an HTTP/2-enabled service secured with IAP. See load balancer modes for more details.

Using VPC with Cloud SQL with egress settings

When using the Public IP method of connecting to Cloud SQL, you cannot use a Cloud SQL connection in Cloud Run with a serverless VPC connector that has the egress setting all-traffic.

IP addresses not clearly identified when in use by serverless

When using Direct VPC egress, IP addresses reserved by Cloud Run are identified as in use by "None" rather than by "Serverless" when viewing the IP addresses page in the Google Cloud console.

Unsupported HTTP request methods

Requests with HTTP methods TRACE and CONNECT are not supported and therefore will not be received by services running on Cloud Run.

Reserved URL paths

It is not possible to use the following URL paths:

• /eventlog
• Paths starting with /_ah/
• Some paths ending with z. We recommend avoiding all paths that end in z to not collide with reserved paths.

Some encoded URL characters are decoded

Some encoded characters in URL of Cloud Run services are decoded by Cloud Run before reaching the container instance. For example, %41 is automatically decoded to A.

HOME environment variable is set to /home in first generation execution environment

The Cloud Run first generation execution environment sets the HOME environment variable to /home. The second generation execution environment does not set this variable.

Restricted subnet when accessing VPC network destinations

If you access any destination through a private IP, the destination cannot be on the subnet 192.168.1.0/24. Using this subnet prevents Cloud Run from communicating with the destination.

You can't mount secrets on /tmp in first generation execution environment

If you use first generation execution environment, you cannot mount secrets on /tmp directly. However, you can mount secrets on any subdirectory of /tmp.

Second generation execution environment overrides /tmp

The second generation execution environment mounts an empty tmpfs to /tmp. This means that any data in your container's /tmp is inaccessible to your service.

Cloud Run job tasks might be spuriously marked as retried

In some situations, a task can be marked as having been retried, when in fact the task succeeded on its first try. Until this issue is resolved, Google recommends keeping the --max-retries parameter set to 3 or higher to avoid spurious execution failures.

VPC network egress does not support IPv6

You cannot use IPv6 when sending traffic through Direct VPC egress or Serverless VPC Access connectors. Note that IPv6 is supported when accessing non-VPC endpoints while vpc-egress is set to private-ranges-only.

Volume Mounts are incompatible with Skaffold, Config Connector, and integrations

If you deploy your Cloud Run service or job with Skaffold, Config Connector or Cloud Run integrations, your volume mounts won't be persisted next time you deploy. You may also experience issues using Skaffold, Config Connector, or Cloud Run integrations with services or jobs that have volume mounts already applied. We are working on resolving this issue.

File descriptor limits

The maximum limit of file descriptors for Cloud Run first and second generation environments is 25,000 per instance. This is an hard-limit. If you exceed the limit your instance might run out of sockets.