How to authenticate google cloud SDK on a docker Ubuntu image?

docker docker-compose google-cloud-sdk
AspiringMat picture AspiringMat · Aug 3, 2017 · Viewed 9.2k times · Source

I am a bit confused about how I can authenticate the gcloud sdk on a docker container. Right now, my docker file includes the following:

#Install the google SDK
RUN curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz > /tmp/google-cloud-sdk.tar.gz
RUN mkdir -p /usr/local/gcloud
RUN tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz
RUN /usr/local/gcloud/google-cloud-sdk/install.sh
RUN /usr/local/gcloud/google-cloud-sdk/bin/gcloud init

However, I am confused how I would authenticate? When I run gcloud auth application-default login on my machine, it opens a new tab in chrome which prompts me to login. How would I input my credentials on the docker container if it opens a new tab in google chrome in the container?

Answer

cherba picture cherba · Aug 5, 2017

You might consider using deb packages when setting up your docker container as it is done on docker hub.

That said you should NOT run gcloud init or gcloud auth application-default login or gcloud auth login... those are interactive commands which launch browser. To provide credentials to the container supply it with service account key file.

You can download one from cloud console: https://console.cloud.google.com/iam-admin/serviceaccounts/project?project=YOUR_PROJECT or create it with gcloud command

gcloud iam service-accounts keys create

see reference guide.

Either way once you have the key file ADD it to your container and run

gcloud auth activate-service-account --key-file=MY_KEY_FILE.json

You should be now set, but if you want to use it as Application Default Credentials (ADC), that is in the context of other libraries and tools, you need to set the following environment variable to point to the key file:

export GOOGLE_APPLICATION_CREDENTIALS=/the/path/to/MY_KEY_FILE.json

One thing to point out here is that gcloud tool does not use ADC, so later if you change your account to something else, for example via

gcloud config set core/account [email protected]

other tools and libraries will continue using old account via ADC key file but gcloud will now use different account.

Related questions

Using Docker-Compose, how to execute multiple commands

I want to do something like this where I can run multiple commands in order. db: image: postgres web: build: . command: python manage.py migrate command: python manage.py runserver 0.0.0.0:8000 volumes: - .:/code ports: - "8000:8000" links: - db

Read More
How to rebuild docker container in docker-compose.yml?

There are scope of services which defined in docker-compose.yml. These service have been started. I need to rebuild only one of these and start it without up other services. I run the following commands: docker-compose up -d # run all …

Read More
How to fix docker: Got permission denied issue

I installed Docker in my machine where I have Ubuntu OS. After than I installed docker, when I run sudo docker run hello-world All it's ok, but I want to hide the word sudo to make more short the command. …

Read More