Cannot Mount .env File in Cloud Run

[kresnasatya]

Hi there! I have try to mount an .env file as secret volume into Cloud Run service (GCP) but it false. Here's what I have try so far:

1. Create a Secret Manager in GCP and give name the secret .e.g. laravel-secret. Next, put all content in .env file into the laravel-secret. E.g.

APP_NAME=Laravel APP_ENV=production APP_KEY=<base64-key> APP_DEBUG=false APP_URL=<domain-url> DB_CONNECTION=mysql DB_HOST=127.0.0.1 DB_PORT=3306 DB_DATABASE=laravel DB_USERNAME=root DB_PASSWORD= 

2. I create an webapp.yaml file for create Cloud Run service.

apiVersion: serving.knative.dev/v1 kind: Service metadata: name: laravel-webapp annotations: run.googleapis.com/minScale: '1' spec: template: metadata: name: laravel-webapp-$CI_COMMIT_SHORT_SHA annotations: run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]' run.googleapis.com/vpc-access-egress: 'private-ranges-only' spec: serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com containers: - name: laravel-webapp image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA env: - name: APP_NAME value: Laravel - name: LOG_STACK value: stderr - name: LOG_STDERR_FORMATTER value: "Monolog\\Formatter\\GoogleCloudLoggingFormatter" volumeMounts: - name: env-file # Mount the secret as /.env mountPath: /var/www/html/.env volumes: - name: env-file secret: secretName: laravel-secret items: - key: latest path: .env 

I try the step 2 and I get 500 server error. I get the log message: No application encryption key has been specified..

3. I modify the step 2 like this:

apiVersion: serving.knative.dev/v1 kind: Service metadata: name: laravel-webapp annotations: run.googleapis.com/minScale: '1' spec: template: metadata: name: laravel-webapp-$CI_COMMIT_SHORT_SHA annotations: run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]' run.googleapis.com/vpc-access-egress: 'private-ranges-only' spec: serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com containers: - name: laravel-webapp image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA env: - name: APP_NAME value: Laravel - name: LOG_STACK value: stderr - name: LOG_STDERR_FORMATTER value: "Monolog\\Formatter\\GoogleCloudLoggingFormatter" volumeMounts: - name: env-file # Mount the secret as /.env - mountPath: /var/www/html/.env + mountPath: /var/www/html volumes: - name: env-file secret: secretName: laravel-secret items: - key: latest path: .env

I try the step 2 and I get File not found.

4. I modified step 3 and use env variables instead of mount secret volume.

apiVersion: serving.knative.dev/v1 kind: Service metadata: name: laravel-webapp annotations: run.googleapis.com/minScale: '1' spec: template: metadata: name: laravel-webapp-$CI_COMMIT_SHORT_SHA annotations: run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]' run.googleapis.com/vpc-access-egress: 'private-ranges-only' spec: serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com containers: - name: laravel-webapp image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA env: - name: APP_NAME value: Laravel - name: APP_KEY valueFrom: secretKeyRef: key: latest name: laravel_webapp_app_key - name: APP_ENV value: production - name: APP_DEBUG value: "false" 

I try the step 4 and IT WORKS!

Then, I take a short conclusion that the serversideup/docker-php cannot read the .env fle that mounted from Cloud Run. Here's my Dockerfile to build the docker image for Laravel project in Cloud Run.

# # Vendor Dependencies # FROM serversideup/php:8.3-cli AS vendor USER root ENV COMPOSER_ALLOW_SUPERUSER=1 COPY app /app/app COPY database /app/database # COPY helpers /app/helpers/ COPY composer.json /app/composer.json COPY composer.lock /app/composer.lock WORKDIR /app RUN composer install --prefer-dist --no-ansi --no-interaction --no-progress --no-scripts --classmap-authoritative # # NPM Dependencies # FROM node:18-alpine AS npm # Install pnpm with corepack # RUN npm install --global corepack@latest # RUN corepack enable pnpm RUN mkdir -p /app/public COPY package.json vite.config.js package-lock.json /app/ # COPY public/js/ /app/public/js/ # COPY public/css/ /app/public/css/ COPY resources/ /app/resources/ WORKDIR /app RUN npm install && npm run build # # Application container # FROM serversideup/php:8.3-fpm-nginx-alpine USER www-data # Copies the Laravel app, but skips the ignored files and paths COPY --chown=www-data:www-data . . COPY --chown=www-data:www-data --from=vendor /app/vendor/ /var/www/html/vendor/ COPY --chown=www-data:www-data --from=npm /app/public/ /var/www/html/public/ ENV AUTORUN_ENABLED="true" \ # AUTORUN_LARAVEL_MIGRATION="true" \ # AUTORUN_LARAVEL_MIGRATION_ISOLATION="true" \ PHP_OPCACHE_ENABLE="1" 

I'm curious, is that possible to mount .env file for laravel project in Cloud Run by using serversideup/php? If it's possible then what's should I change in my Dockerfile? If it's not possible then why?

Thank you.

[jaydrogers]

I've never used Cloud Run before, but I wonder if it is mounting the ENV file as root with 600 permissions and our default user of www-data does not have access to it?

You might have to dive into the docs and see if they support setting the ENV file to a different user

[kresnasatya]

Hi, thanks for replying. I think that’s a reason why I cannot mount the .env file into cloud run containers. Anyway, instead of using mount .env as volume, I will put the .env variables on google secret manager. Thanks.