Introduction

A GCP Cloud Run service can be deployed successfully and still remain unreachable if traffic is blocked before it reaches the active revision. In most cases, the break happens at the edge of the service: ingress restrictions, IAM authentication, broken custom domain mapping, or a load balancer and serverless NEG that no longer point to the right backend.

Symptoms

  • Requests to the Cloud Run URL or custom domain return 403, 404, 502, or connection failures.
  • The service appears deployed, but users cannot reach it from the browser or API client.
  • Internal callers work while public traffic fails, or public traffic works while internal callers fail.
  • A recent revision was deployed, but the service URL now routes incorrectly or times out.
  • Load balancer logs show backend failures even though the container starts successfully.

Common Causes

  • Cloud Run ingress is restricted to internal traffic or internal-and-load-balancing only.
  • The caller lacks Cloud Run Invoker permission and the service still requires authentication.
  • The custom domain mapping, DNS records, or managed certificate status is incomplete.
  • The listening port in the container does not match the PORT expected by Cloud Run.
  • The active revision fails startup probes, crashes quickly, or never becomes ready.
  • A load balancer, serverless NEG, or URL map points to the wrong backend service or outdated revision path.

Step-by-Step Fix

  1. 1.Start with the exact failing entry point: default run.app URL, custom domain, or external load balancer endpoint. Determine whether all entry points fail or only one of them does.
  2. 2.Check the Cloud Run service ingress setting:
  3. 3.```bash
  4. 4.gcloud run services describe my-service --format='value(spec.template.spec.containers[0].ports[0].containerPort)'
  5. 5.gcloud run services describe my-service --format='value(status.traffic[0].url)'
  6. 6.`
  7. 7.If the service should be publicly reachable, ensure ingress is not restricted in a way that blocks the callers you expect.
  8. 8.Review authentication settings:
  9. 9.```bash
  10. 10.gcloud run services describe my-service --format='value(spec.template.spec.serviceAccountName)'
  11. 11.gcloud run services get-iam-policy my-service
  12. 12.`
  13. 13.If unauthenticated access is intended, verify the service allows it. If authentication is required, confirm the caller has the right IAM role.
  14. 14.Inspect the latest revision status and logs:
  15. 15.```bash
  16. 16.gcloud run revisions list --service=my-service
  17. 17.gcloud logging read "resource.type=cloud_run_revision AND resource.labels.service_name=my-service" --limit=20
  18. 18.`
  19. 19.Look for container startup failures, crashes, port binding issues, or readiness problems.
  20. 20.Confirm the application listens on the PORT environment variable:
  21. 21.```bash
  22. 22.# In your application code
  23. 23.const port = process.env.PORT || 8080;
  24. 24.`
  25. 25.Hardcoded ports are a common reason a healthy deployment never becomes reachable.
  26. 26.If you use a custom domain, verify domain mapping status:
  27. 27.```bash
  28. 28.gcloud run domain-mappings describe my-domain.com
  29. 29.`
  30. 30.Check DNS records, certificate provisioning, and whether the domain resolves to the expected Front End.
  31. 31.If traffic goes through an external HTTP(S) load balancer, validate the serverless NEG and backend service:
  32. 32.```bash
  33. 33.gcloud compute backend-services describe my-backend --global
  34. 34.gcloud compute network-endpoint-groups describe my-neg --region=my-region
  35. 35.`
  36. 36.Reproduce the request with curl:
  37. 37.```bash
  38. 38.curl -v https://my-service-abc123.run.app/
  39. 39.curl -v -H "Authorization: Bearer $TOKEN" https://my-service-abc123.run.app/
  40. 40.`
  41. 41.This helps separate Cloud Run service issues from edge routing problems.
  42. 42.After fixing the misconfiguration, deploy or promote the corrected revision:
  43. 43.```bash
  44. 44.gcloud run services update-traffic my-service --to-revisions=my-revision=100
  45. 45.`
  46. 46.Finish by checking Cloud Logging and load balancer logs:
  47. 47.```bash
  48. 48.gcloud logging read "resource.type=http_load_balancer AND resource.labels.url_map_name=my-lb" --limit=20
  49. 49.`

Verification

After applying fixes:

  1. 1.Access the Cloud Run URL and verify successful response
  2. 2.Check custom domain resolves correctly if configured
  3. 3.Verify load balancer routes traffic to correct backend
  4. 4.Confirm logs show successful requests reaching the revision
  5. 5.Test from multiple locations and client types

Prevention

To prevent Cloud Run reachability issues:

  1. 1.Document ingress requirements - Clearly document whether each service should be public, internal, or internal-and-load-balancing only.
  2. 2.Use consistent port handling - Always use the PORT environment variable in container applications to match Cloud Run expectations.
  3. 3.Implement health checks - Add startup and liveness probes to detect container issues before they affect traffic routing.
  4. 4.Test revisions before traffic assignment - Deploy new revisions without assigning traffic first, then test before promoting.
  5. 5.Monitor custom domains - Set up monitoring for domain mapping status and certificate provisioning delays.
  6. 6.Validate IAM before deployment - Ensure service accounts and IAM policies are correctly configured before deploying services.
  7. 7.Use structured logging - Implement structured logging in containers to make troubleshooting easier when issues occur.
  8. 8.Test all entry points - After changes, test both the default run.app URL and any custom domains or load balancer endpoints
  • [Fix Fix Gcp Autoscaler Not Scaling Issue in GCP](fix-gcp-autoscaler-not-scaling)
  • [Fix Fix Gcp Backend Bucket Not Serving Issue in GCP](fix-gcp-backend-bucket-not-serving)
  • [Fix Fix Gcp Bigquery Dataset Access Denied Issue in GCP](fix-gcp-bigquery-dataset-access-denied)
  • [Fix Fix Gcp Bigquery Materialized View Refresh Failed Issue in GCP](fix-gcp-bigquery-materialized-view-refresh-failed)
  • [Fix Fix Gcp Bigquery Partition Modification Failed Issue in GCP](fix-gcp-bigquery-partition-modification-failed)

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "TechArticle", "headline": "How to Fix GCP Cloud Run Service Not Reachable", "description": "Troubleshoot unreachable GCP Cloud Run services by checking ingress, authentication, domain mapping, revisions, and load balancer routing.", "url": "https://www.fixwikihub.com/fix-gcp-cloud-run-service-not-reachable", "publisher": { "@type": "Organization", "name": "FixWikiHub", "url": "https://www.fixwikihub.com" }, "author": { "@type": "Person", "name": "FixWikiHub Editorial Team" }, "datePublished": "2025-11-03T08:16:37.077Z", "dateModified": "2025-11-03T08:16:37.077Z" } </script>