<@ULVA73B9P> i’m trying to do a cloud run push flo...
# ask-marvinr
Riya Sinha
09/05/2025, 2:45 AM@Marvin i’m trying to do a cloud run push flow, and i keep getting:
Copy code
Flow run infrastructure exited with non-zero status code:
Task ludicrous-zebu-m6wlm-task0 failed with message: The container exited with an error. (Error Code: 1)m
Marvin
09/05/2025, 2:45 AM✅ thought for 531.4 seconds
Marvin
09/05/2025, 2:54 AMThanks for the details — that error usually means the failure happened before a Cloud Run Job could even be created (during packaging, image build/push, or the API call to create the Job). The best clues live in your worker’s logs, not the flow run logs.
Try this debugging checklist:
1) Watch the worker logs in DEBUG
- Restart the worker in the foreground with DEBUG logging so you can see packaging/build/push and Cloud Run API calls:
Copy code
export PREFECT_LOGGING_LEVEL=DEBUG
# ensure the GCP extras are available to the worker
uv run --with 'prefect[gcp]' prefect worker start -p <your-cloud-run-pool> Copy code
docker version
docker info Copy code
gcloud auth configure-docker <region>-docker.pkg.dev Copy code
cat key.json | docker login -u _json_key --password-stdin https://<region>-docker.pkg.dev Copy code
prefect work-pool inspect "<your-cloud-run-pool>" Copy code
uv run --with 'prefect[gcp]' prefect work-pool get-default-base-job-template --type cloud-run Copy code
docker build -t <region>-docker.pkg.dev/<project>/<repo>/prefect-test:tmp - <<'EOF'
FROM <http://gcr.io/distroless/python3|gcr.io/distroless/python3>
CMD ["python","-c","print('ok')"]
EOF
docker push <region>-docker.pkg.dev/<project>/<repo>/prefect-test:tmp Copy code
gcloud run jobs create prefect-test --image <region>-docker.pkg.dev/<project>/<repo>/prefect-test:tmp --region <region> --project <project>
gcloud run jobs execute prefect-test --region <region> --project <project> --wait@flow(log_prints=True)docker logs ...kubectl logs ...journalctl -u ...r
Riya Sinha
09/05/2025, 3:12 AM@Marvin does the workpool image get overriden by the deployment image? or is the work pool image for managing the flow execution, and the deployment image is for the flow code location?
remember i’m using google cloud run with a flow code containing image in artifact registry taht is prebuilt.
m
Marvin
09/05/2025, 3:12 AM✅ thought for 123.8 seconds
Marvin
09/05/2025, 3:14 AMGreat question. Short answer:
- The “image” in your Cloud Run work pool’s base job template is just a default runtime image for flow runs.
- A deployment can override that image via job variables. If both specify an image, the deployment’s image wins.
- There is no separate “manager” image for the work pool. The worker is a Python process that submits Cloud Run Jobs; the Cloud Run Job runs the image you specify (from the pool template, unless overridden by the deployment).
In your case (prebuilt flow-code image in Artifact Registry):
- Point Prefect to your prebuilt image either in the work pool template or, better, in the deployment’s job variables.
- Ensure your image includes Prefect and your flow’s dependencies, and that Cloud Run can override the command/args (so Prefect can start the flow runner inside the container).
Example prefect.yaml snippet:
Copy code
deployments:
- name: prod
entrypoint: flows/my_flow.py:my_flow
work_pool:
name: my-cloud-run-pool
job_variables:
image: us-central1-docker.pkg.dev/<project>/<repo>/<image>:<tag>
region: us-central1
project: <project>
service_account: my-sa@<project>.<http://iam.gserviceaccount.com|iam.gserviceaccount.com>r
Riya Sinha
09/05/2025, 3:31 AMhow does debug mode work in this case? @Marvin
my deployment does have job variables:
Copy code
{
"image": "***/vsp-flows:latest",
"credentials": {
"$ref": {
"block_document_id": "bca402ce-58e3-4be3-a60a-e774af172c1f"
}
}
} Copy code
{
"type": "********",
"auth_uri": "********",
"client_id": "********",
"token_uri": "********",
"project_id": "********",
"private_key": "********",
"client_email": "********",
"private_key_id": "********",
"universe_domain": "********",
"client_x509_cert_url": "********",
"auth_provider_x509_cert_url": "********"
}m
Marvin
09/05/2025, 3:31 AM✅ thought for 46.4 seconds
Marvin
09/05/2025, 3:32 AMGreat follow-up.
How “debug mode” works here
- The logs you need are your worker’s logs. Setting DEBUG on the worker will surface the packaging/build/push steps and the Cloud Run Jobs API calls that happen before any Job is created.
- Enable it by setting
PREFECT_LOGGING_LEVEL=DEBUG Copy code
export PREFECT_LOGGING_LEVEL=DEBUG
uv run --with 'prefect[gcp]' prefect worker start -p <your-cloud-run-pool>PREFECT_LOGGING_LEVEL=DEBUGdocker logskubectl logsGcpCredentialsjob_variables.credentialsprojectregionservice_accountjob_variables Copy code
<region>-docker.pkg.dev/<project>/<repo>/<image>:<tag> Copy code
service_account: <sa-name>@<project>.<http://iam.gserviceaccount.com|iam.gserviceaccount.com> Copy code
deployments:
- name: prod
entrypoint: flows/my_flow.py:my_flow
work_pool:
name: my-cloud-run-pool
job_variables:
image: us-central1-docker.pkg.dev/my-proj/my-repo/vsp-flows:1.2.3
project: my-proj
region: us-central1
service_account: <mailto:my-cloud-run-sa@my-proj.iam.gserviceaccount.com|my-cloud-run-sa@my-proj.iam.gserviceaccount.com>
credentials:
$ref:
block_document_id: bca402ce-58e3-4be3-a60a-e774af172c1f:latest Copy code
prefect work-pool inspect "<your-cloud-run-pool>" Copy code
uv run --with 'prefect[gcp]' prefect work-pool get-default-base-job-template --type cloud-runinspectr
Riya Sinha
09/05/2025, 3:57 AMi have the service account and region specified in the workpool not the deployment i think, is that ok?:
Copy code
{
"cpu": {
"type": "string",
"title": "CPU",
"default": "1000m",
"example": "1000m",
"pattern": "^(\\d*000)m$",
"description": "The amount of compute allocated to the Cloud Run Job. (1000m = 1 CPU)."
},
"env": {
"type": "object",
"title": "Environment Variables",
"default": {
"DEPLOYMENT_TYPE": "cloud",
"PYTHONUNBUFFERED": "1",
"PREFECT_LOGGING_LEVEL": "DEBUG"
},
"description": "Environment variables to set when starting a flow run.",
"additionalProperties": {
"type": "string"
}
},
"name": {
"type": "string",
"title": "Name",
"description": "Name given to created infrastructure."
},
"image": {
"type": "string",
"title": "Image Name",
"default": "docker.io/prefecthq/prefect:3-latest",
"example": "docker.io/prefecthq/prefect:3-latest",
"description": "The image to use for a new Cloud Run Job. If not set, the latest Prefect image will be used."
},
"labels": {
"type": "object",
"title": "Labels",
"description": "Labels applied to created infrastructure.",
"additionalProperties": {
"type": "string"
}
},
"memory": {
"type": "string",
"title": "Memory",
"default": "1Gi",
"example": "512Mi",
"pattern": "^\\d+(?:G|Gi|M|Mi)$",
"description": "The amount of memory allocated to the Cloud Run Job. Must be specified in units of 'G', 'Gi', 'M', or 'Mi'."
},
"region": {
"type": "string",
"title": "Region",
"default": "us-west1",
"example": "us-west1",
"description": "The region where the Cloud Run Job resides."
},
"command": {
"type": "string",
"title": "Command",
"description": "The command to use when starting a flow run. In most cases, this should be left blank and the command will be automatically generated."
},
"timeout": {
"type": "integer",
"title": "Job Timeout",
"default": 600,
"maximum": 3600,
"description": "The length of time that Prefect will wait for Cloud Run Job state changes.",
"exclusiveMinimum": 0
},
"keep_job": {
"type": "boolean",
"title": "Keep Job After Completion",
"default": false,
"description": "Keep the completed Cloud Run Job after it has run."
},
"credentials": {
"title": "GCP Credentials",
"description": "The GCP Credentials used to initiate the Cloud Run Job. `service_account_info` is required.",
"anyOf": [
{
"type": "object",
"title": "GcpCredentials",
"properties": {
"project": {
"type": "string",
"title": "Project",
"description": "The GCP project to use for the client."
},
"service_account_file": {
"type": "string",
"title": "Service Account File",
"format": "path",
"description": "Path to the service account JSON keyfile."
},
"service_account_info": {
"type": "object",
"title": "Service Account Info",
"description": "The contents of the keyfile as a dict."
}
},
"description": "Block used to manage authentication with GCP. Google authentication is handled via the `google.oauth2. See Google's [Authentication documentation](<https://cloud.google.com/docs/authentication#service-accounts>) for details on inference and recommended authentication patterns.",
"secret_fields": [
"service_account_info.*"
],
"block_type_slug": "gcp-credentials",
"block_schema_references": {}
}
]
},
"service_account_name": {
"type": "string",
"title": "Service Account Name",
"default": "name@project.iam.gserviceaccount.com",
"example": "service-account@example.iam.gserviceaccount.com",
"description": "The name of the service account to use for the task execution of Cloud Run Job. By default Cloud Run jobs run as the default Compute Engine Service Account."
}
}m
Marvin
09/05/2025, 3:58 AM✅ thought for 44.5 seconds
Marvin
09/05/2025, 3:59 AMShort answer: yes — it’s fine to put region and service account in the work pool and just set the image + credentials in the deployment. Deployment job variables override the pool’s defaults; anything not provided by the deployment falls back to the pool template.
A few important checks based on what you shared:
What your deployment provides
- image: Make sure it’s fully qualified for Artifact Registry:
- Should look like:
<region>-docker.pkg.dev/<project>/<repo>/vsp-flows:<tag>:latestGcpCredentials$refprojectservice_account_info.project_idprojectus-west1<mailto:my-sa@my-project.iam.gserviceaccount.com|my-sa@my-project.iam.gserviceaccount.com>image<region>-docker.pkg.dev/...service_account_name Copy code
prefect work-pool inspect "<your-cloud-run-pool>" Copy code
uv run --with 'prefect[gcp]' prefect work-pool get-default-base-job-template --type cloud-runprefect work-pool inspect <pool>