Set GOOGLE_APPLICATION_CREDENTIALS in Docker

Question

I want to set GOOGLE_APPLICATION_CREDENTIALS inside my docker container using my key.json file but I don't want to copy this file into my container.

Mcguinness

What do you want to use? There are many methods. One is to use a Docker Volume: docs.docker.com/storage/volumes Another is Docker Secrets: blog.docker.com/2017/02/docker-secrets-management – Naashom

I want to set credentials while using docker run – Mcguinness

Did you read the links that I provided? The first one shows you how to use Docker run and attach a directory on your host so that you can read the file inside the container. – Naashom

Answer 1

 docker run \
   -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/[FILE_NAME].json \
   -v $GOOGLE_APPLICATION_CREDENTIALS:/tmp/keys/[FILE_NAME].json:ro \
   gcr.io/[PROJECT_ID]/[IMAGE]

Ref: https://cloud.google.com/run/docs/testing/local

Monica

Thank you. I was looking for this. – Winnah

Should we have GOOGLE_APPLICATION_CREDENTIALS ready in our local? I've never set GOOGLE_APPLICATION_CREDENTIALS in my local. And do you now what is 'ro' means in -v? – Sjoberg

@Sjoberg You have to pass the credential. ro means read only. – Monica

Also, you can define the env variable in the Dockerfile. And make this command little shorter – Tucson

better link cloud.google.com/run/docs/testing/local#docker-with-gcp-access – Ethylene

Latest link: cloud.google.com/run/docs/testing/… – Ostrowski

Answer 2

For anyone who is using a key file in the current working directory:

docker run \
  -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/[FILE_NAME].json \
  -v $(pwd):/tmp/keys/[FILE_NAME].json:ro \
  gcr.io/[PROJECT_ID]/[IMAGE]

Cleft

Answer 3

I used something like norththree in https://mcmap.net/q/438590/-set-google_application_credentials-in-docker

But I did not want to have to put in the FILE_NAME all the time:

   docker run \
     -e GOOGLE_APPLICATION_CREDENTIALS=$GOOGLE_APPLICATION_CREDENTIALS \
     -v $GOOGLE_APPLICATION_CREDENTIALS:$GOOGLE_APPLICATION_CREDENTIALS:ro \
     gcr.io/[PROJECT_ID]/[IMAGE]

This mounts the credential file at the same path in the docker container as it is outside. The only advantage of this is that you don't have to figure out FILE_NAME so you can put this in your README and your coworkers can just copy and paste into their shell.

Charily

Answer 4

I had the same problem. If you want to do it in Windows then:

Firstly add a system variable GOOGLE_APPLICATION_CREDENTIALS in windows: enter image description here

Make sure a path to your json file exists.

Reboot cmd if it was running. Exec echo %GOOGLE_APPLICATION_CREDENTIALS% command in cmd to be sure you did it correctly.

Then you should exec a command which runs a docker container with creating a json file in a container and setting an environment variable which points to this json file. -v flag creates this json file, syntax is path_to_your_json_file(here we put a system variable we set earlier):path_to_file_in_a_container_we_want_to_create:rights(ro means read only). -e flag creates a variable in a container which points to json file we set using -v flag (a value of this flag is the second part of a v flag value).

So the final command may look like this:

docker run -e GOOGLE_APPLICATION_CREDENTIALS=/tmp/keys/application_default_credentials.json -v %GOOGLE_APPLICATION_CREDENTIALS%:/tmp/keys/application_default_credentials.json:ro [other flags] image_name:image_tag

Midgett

Answer 5

If you want to set credentials using docker run, you can supply the file with the --env-file flag, or supply the arguement with --env

The tricky part is, since it's in json, you would have to cat the json file, grep the variable you're looking for, replace the colon with =, and remove the brackets. That's a lot of work.

Instead, why don't you just create file, inside the file use key = value notation, and supply the file with:

docker run --env-file my_config_file ....

Prospective