Deploy to Cloud Run

Your site works locally. Now turn it into a public URL anyone can hit. Cloud Run takes your code, builds a container, runs it on demand, and scales to zero when nobody's looking — you only pay for actual traffic.

Pre-flight check

Before you run the deploy, confirm the things you set up in step 1 are still in place. Two commands:

gcloud config get-value project

gcloud auth list

The first prints your project ID. The second shows the active Google account marked with *. If either is wrong, fix it before you deploy or you'll burn credits in the wrong place.

Review the Dockerfile

As part of scaffolding in step 5, the agent wrote a small Dockerfile at the project root. It looks roughly like this:

FROM node:20-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 8080
CMD ["node", "server.js"]

In plain terms: start from a slim Node 20 image, install runtime dependencies, copy the project (your public/ folder + server.js), expose port 8080 (the Cloud Run default — the server reads process.env.PORT so it picks this up automatically), and run the server. Single-stage on purpose: the site is plain HTML/CSS, there's nothing to build.

Already comfortable with Node Dockerfiles? Skip ahead to the deploy section.

Confirm Cloud Build can deploy

Step 1C had you grant the Cloud Build service account the IAM role roles/run.builder. If you skipped that or you're not sure, run it now — it's idempotent (re-running is safe):

PROJECT_ID=$(gcloud config get-value project)
PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/run.builder"

Without this binding the first gcloud run deploy --source call fails with a permission error pointing at this exact role. Pre-staging it in setup is what makes the deploy block reliably finish in 20 minutes instead of 35.

Deploy the site

From the project root (the folder you scaffolded into in step 5), run:

gcloud run deploy --source .

--source . tells Cloud Run to package the current directory and ship it to Cloud Build, which builds the container, pushes it to Artifact Registry, and rolls it out as a Cloud Run service.

The first time you run it, gcloud asks four questions in order. Recommended answers for the workshop:

1. Service name — press Enter to accept the default (the directory name) or type something like career-site. The name becomes part of the public URL.
2. Region — Google's data centres are scattered worldwide; you pick one. Choose close to you so latency is low (europe-west1 for Belgium, us-central1 for Iowa, asia-southeast1 for Singapore). Cloud Run remembers this default for next time.
3. Create an Artifact Registry repository? — answer Y. This creates the per-project storage bucket for your container images. One-time per project.
4. Allow unauthenticated invocations? — answer y for a public website. ("Unauthenticated" just means: anyone with the URL can hit it, no login required. Like a normal public webpage. The opposite — internal-only services — is for back-office tools where only your team should reach it.)

Verify the public URL

When the deploy finishes, gcloud prints a Service URL on the last line of the output:

Service URL: https://career-site-xxxxxxxx-ew.a.run.app

The shape is always https://<service-name>-<hash>-<region-code>.a.run.app. Most terminals make it clickable — Cmd-click (macOS) or Ctrl-click (Windows/Linux) to open in your default browser. Or copy-paste it.

Open it and check:

• The page loads with your design, your projects, and your contact info from the Antigravity build.
• The FAQ section is visible.
• It works on mobile — pull it up on your phone.

Share the URL in the workshop chat. This is your live career site.

One-line redeploy after changes

Once you've answered the prompts the first time, gcloud remembers your defaults. Iteration deploys are now a single command:

gcloud run deploy --source .

Press Enter through the prompts and Cloud Build does the rest.

Or: explicit one-shot command

Prefer to script it without prompts? This is the explicit form. Useful when you want to wire deploy into a CI job later:

gcloud run deploy career-site \
  --source . \
  --region europe-west1 \
  --allow-unauthenticated \
  --set-env-vars "GOOGLE_CLOUD_PROJECT=$(gcloud config get-value project),LOCATION=europe-west1"

The env vars are pre-wired for the bonus chatbot — they cost nothing if you never use them.

gcloud run deploy ____________ \
  --source . \
  --region ____________ \
  --allow-unauthenticated

gcloud run deploy career-site-us \
  --source . \
  --region us-central1 \
  --allow-unauthenticated

Or: ask the agent to wrap it in a deploy.sh

Want a one-liner you can re-run without remembering flags? Ask the agent in step 5 (or now, if you go back) to write a deploy.sh wrapper at the project root that runs the explicit form above plus an APIs sanity-check. Then:

./deploy.sh

It's about 30 lines of shell — tiny enough to read top-to-bottom before you trust it.

Watch the logs (optional)

If something looks off after deploy, stream the recent logs from your service:

gcloud run services logs read career-site --region europe-west1 --limit 20

Optional: custom domain

Skip this if you don't already own a domain. Cloud Run can serve your site from a custom domain via domain mappings:

gcloud run domain-mappings create \
  --service career-site \
  --domain your-domain.com \
  --region europe-west1

You'll need to add the DNS records Cloud Run shows you with your domain registrar. Propagation can take a few minutes to a few hours.

Troubleshooting

PROJECT_ID=$(gcloud config get-value project)
PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)')

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/run.builder"

gcloud services enable \
  run.googleapis.com \
  artifactregistry.googleapis.com \
  cloudbuild.googleapis.com \
  aiplatform.googleapis.com

// package.json
"engines": { "node": "20" }

gcloud run services logs read SERVICE_NAME --region europe-west1 --limit 50

app.listen(process.env.PORT || 3000);