Mapping custom domains

You can set up a custom domain rather than the default address that Cloud Run provides for a deployed service.

There are a couple of ways to set up a custom domain for a Cloud Run service:

One advantage of using an HTTP(S) load balancer is that it gives you more control around your custom domain setup. For example, it allows you to use your own TLS certificate rather than the certificate that is automatically supplied when you use Cloud Run domain mapping. Using the load balancer also lets you route specific URL paths to the Cloud Run service.

Cloud Run domain mapping limitations

It is not possible to use Cloud Run domain mappings in the following regions:

  • asia-east2
  • asia-northeast2
  • asia-northeast3
  • asia-southeast2
  • asia-south1
  • asia-south2
  • australia-southeast1
  • australia-southeast2
  • europe-central2
  • europe-west2
  • europe-west3
  • europe-west6
  • northamerica-northeast1
  • southamerica-east1
  • us-west2
  • us-west3
  • us-west4

In these regions, the only way to set up a custom domain is by configuring an HTTP(S) load balancer.

When you use Cloud Run domain mappings, you map a custom domain to your service, then update your DNS records. You can map a domain, such as example.com or a subdomain, such as subdomain.example.com. You can only map a domain to /, not to a specific URL path like /users. The following considerations apply:

  • A managed certificate for HTTPS connections is automatically issued and renewed when you map a service to a custom domain.
  • Provisioning the SSL certificate usually takes about 15 minutes but can take up to 24 hours.
  • You cannot upload and use your own certificates.
  • You can map multiple custom domains to the same Cloud Run service.

Before you begin

Purchase a new domain, unless you already have one that you want to use. You can use any domain name registrar, but if you use Google Domains or Cloud Domains, the domain is automatically verified for Cloud Run, so you won't have to go through the domain verification process.

If you want to register a domain with Cloud Domains, see Registering a domain with Cloud Domains within the Cloud Run console.

Mapping a custom domain to a service

You can use the Google Cloud Console or the gcloud command line tool to map a custom domain to a service.

Console

  1. Open the domain mappings page in the Google Cloud Console:
    Domain mappings page

    Note that if your display window is too small, the Mapping Custom Domains button isn't displayed and you must click the 3-dot vertical ellipse icon at the right corner of the page.

  2. In the Domain Mappings page, click Add Mapping.

  3. From the dropdown list in the Add Mapping form, select the service you are mapping the custom domain to:

    Add domain mappings

  4. Enter the domain name.

  5. Click Continue.

  6. You need to verify the ownership of a domain before being able to use it, unless you purchased your domain from Google. If you want to map subdomain.example.com, you should verify ownership of example.com. For more information on verifying domain ownership, refer to Webmaster Central help

  7. Update your DNS records at your domain registrar web site using the DNS records displayed in the last step. You can display the records at any time by clicking DNS Records in the "..." action menu for a domain mapping.

  8. Click Done.

Command line

  1. You must verify domain ownership the first time you use that domain in the Google Cloud project, unless you purchased your custom domain from Google. You can determine whether the custom domain you want to use has been verified by using the command

    gcloud domains list-user-verified

    If your ownership of the domain needs to be verified, open the Webmaster Central verification page:

    gcloud domains verify BASE-DOMAIN

    where BASE-DOMAIN is the base domain you want to verify. For example, if you want to map subdomain.example.com, you should verify the ownership of example.com.

    In Webmaster Central, complete domain ownership verification. For more information, refer to Webmaster Central help.

  2. Map your service to the custom domain:

    gcloud beta run domain-mappings create --service SERVICE --domain DOMAIN
    • Replace SERVICE with your service name.
    • Replace DOMAIN with your custom domain, for example, example.com or subdomain.example.com

Add your DNS records at your domain registrar

After you've mapped your service to a custom domain in Cloud Run, you need to update your DNS records at your domain registrar. As a convenience, Cloud Run generates and displays the DNS records you need to enter. You must add these records that point to the Cloud Run service at your domain registrar for the mapping to go into effect.

If you're using Cloud DNS as your DNS provider, see Adding a record.

  1. Retrieve the DNS record information for your domain mappings using:

    Console

    1. Go to the Cloud Run domain mappings page:
      Domain mappings page

    2. Click the 3-dot vertical ellipse icon to the right of your service, then click DNS RECORDS to display all the DNS records:

    select DNS records

    Command line

    gcloud beta run domain-mappings describe --domain [DOMAIN]

    Replace [DOMAIN] with your custom domain, for example, example.com or subdomain.example.com.

    You need all of the records returned under the heading resourceRecords.

  2. Log in to your account at your domain registrar and then open the DNS configuration page.

  3. Locate the host records section of your domain's configuration page and then add each of the resource records that you received when you mapped your domain to your Cloud Run service.

  4. When you add each of the above DNS records to the account at the DNS provider:

    • Select the type returned in the DNS record in the previous step: A, or AAAA, or CNAME.
    • Use the name www to map to www.example.com.
    • Use the name @ to map example.com.
  5. Save your changes in the DNS configuration page of your domain's account. In most cases, it takes only a few minutes for these changes to take effect, but in some cases it can take up to several hours, depending on the registrar and the Time-To-Live (TTL) of any previous DNS records for your domain. You can use a dig tool, such as this online dig version, to confirm the DNS records have been successfully updated.

  6. Test for success by browsing to your service at its new URL, for example https://www.example.com. Note that it can take several minutes for the managed SSL certificate to be issued.

Adding verified domain owners to other users or service accounts

When a user verifies a domain, that domain is only verified to that user's account. This means that only that user can add more domain mappings that use that domain. So, to enable other users to add mappings that use that domain, you must add them as verified owners.

If you need to add verified owners of your domain to other users or service accounts, you can add permission through the Webmaster Central page:

  1. Navigate to this address in your web browser:

    https://www.google.com/webmasters/verification/home

  2. Under Properties, click the domain for which you want to add a user or service account.

  3. Scroll down to the Verified owners list, click Add an owner, and then enter a Google Account email address or service account ID.

    To view a list of your service accounts, open the Service Accounts page in the Cloud Console:

    Go to Service Accounts page

Registering a domain with Cloud Domains within the Cloud Run console

To register a domain with Cloud Domains within the Cloud Run console, follow these steps:

  1. Go to Cloud Run
  2. Click Manage custom domains.
  3. Click Register domain.
  4. Complete the registration process following the instructions for Registering a domain.
  5. Map your domain to Cloud Run and add DNS records at your domain registrar.