Cloud Run Samples

This sample demonstrates how to perform low-priority, offline video transcoding using FFmpeg with NVIDIA NVENC acceleration on Google Cloud Run Jobs. It is designed to handle batch transcoding of videos up to 8GiB in size.

For a detailed step-by-step walkthrough, refer to the official Google Cloud tutorial: GPU-accelerated video transcoding with FFmpeg on Cloud Run jobs.

To build the container image for this sample, you must first set your Google Cloud Project ID and your Artifact Registry repository path as environment variables. Then, use Cloud Build to submit the build to Google Cloud.

export GOOGLE_CLOUD_PROJECT=<PROJECT_ID>
export AR_REPO_NAME=us-central1-pkg.dev/${GOOGLE_CLOUD_PROJECT}/containers

gcloud builds submit -t "${AR_REPO_NAME}/jobs-shell"

Once a job is created, you can trigger its execution using the gcloud run jobs execute command. Use the --wait flag to block the terminal until the job execution completes.

gcloud run jobs execute jobs-shell --wait

A Serverless VPC Access connector is required to allow Cloud Run or Cloud Functions to send traffic through a VPC network. Use the gcloud compute networks vpc-access connectors create command. Ensure you specify a --range that does not overlap with existing IP ranges in your VPC.

gcloud compute networks vpc-access connectors create serverless-connector \
--region=${_SERVICE_REGION} --range=10.8.0.0/28

To run this sample, you must have a Google Cloud Project with the following APIs enabled:

• Cloud Run
• Cloud Functions
• Serverless VPC Access API

Use the gcloud run jobs create command to deploy the shell sample to Cloud Run. You can configure the number of tasks, retry logic, and environment variables for the job execution.

gcloud run jobs create jobs-shell \
  --set-env-vars FAIL_RATE=0.4,SLEEP_MS=5000 \
  --max-retries 10 \
  --tasks 5 \
  --image "${AR_REPO_NAME}/jobs-shell"

Deploy a Cloud Function with --ingress-settings=internal-only to restrict access so that only services within your project can call it. This prevents public internet access to the function.

Run this command from inside the vpc-sample directory:

gcloud functions deploy restricted-function \
--runtime=python311 --trigger-http --no-allow-unauthenticated \
--ingress-settings=internal-only --entry-point=hello_world

Authenticated Requests

To test the service with an identity token:

curl --header "Authorization: Bearer $(gcloud auth print-identity-token)" <cloud-run-mc-service-url>

Allow Unauthenticated Access

To make the service publicly accessible to anyone (allUsers):

gcloud run services add-iam-policy-binding $MC_SERVICE_NAME \
    --member="allUsers" \
    --role="roles/run.invoker"

Once unauthenticated access is allowed, you can access the service via a simple curl:

curl <cloud-run-mc-service-url>

# Authenticated
curl --header "Authorization: Bearer $(gcloud auth print-identity-token)" <cloud-run-mc-service-url>

# Allow unauthenticated
gcloud run services add-iam-policy-binding $MC_SERVICE_NAME \
    --member="allUsers" \
    --role="roles/run.invoker"

# Unauthenticated
curl <cloud-run-mc-service-url>

Deploy the service using a service.yaml configuration file. You must substitute the service name and region in the YAML file before deployment.

1. Set your environment variables:

export MC_SERVICE_NAME=<service-name>
export REGION=us-central1

2. Substitute the variables into service.yaml:

sed -i -e s/MC_SERVICE_NAME/${MC_SERVICE_NAME}/g -e s/REGION/${REGION}/g service.yaml

3. Deploy the service:

gcloud run services replace service.yaml

Service Architecture

By default, this deployment includes two containers:

• nginx: The serving ingress container (entrypoint) listening on port 8080.
• hello: A sidecar container.

nginx is configured to proxy requests over to the hello container at port 8888.