Cannot Mount .env File in Cloud Run

[kresnasatya]

Hi there! I have try to mount an .env file as secret volume into Cloud Run service (GCP) but it false. Here's what I have try so far:

1. Create a Secret Manager in GCP and give name the secret .e.g. laravel-secret. Next, put all content in .env file into the laravel-secret. E.g.

APP_NAME=Laravel
APP_ENV=production
APP_KEY=<base64-key>
APP_DEBUG=false
APP_URL=<domain-url>

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=laravel
DB_USERNAME=root
DB_PASSWORD=

2. I create an webapp.yaml file for create Cloud Run service.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: laravel-webapp
  annotations:
    run.googleapis.com/minScale: '1'
spec:
  template:
    metadata:
      name: laravel-webapp-$CI_COMMIT_SHORT_SHA
      annotations:
        run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES
        run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]'
        run.googleapis.com/vpc-access-egress: 'private-ranges-only'
    spec:
      serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com
      containers:
      - name: laravel-webapp
        image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
        env:
        - name: APP_NAME
          value: Laravel
        - name: LOG_STACK
          value: stderr
        - name: LOG_STDERR_FORMATTER
          value: "Monolog\\Formatter\\GoogleCloudLoggingFormatter"
        volumeMounts:
          - name: env-file
            # Mount the secret as /.env
            mountPath: /var/www/html/.env
      volumes:
        - name: env-file
          secret:
            secretName: laravel-secret
            items:
              - key: latest
                path: .env

I try the step 2 and I get 500 server error. I get the log message: No application encryption key has been specified..

3. I modify the step 2 like this:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: laravel-webapp
  annotations:
    run.googleapis.com/minScale: '1'
spec:
  template:
    metadata:
      name: laravel-webapp-$CI_COMMIT_SHORT_SHA
      annotations:
        run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES
        run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]'
        run.googleapis.com/vpc-access-egress: 'private-ranges-only'
    spec:
      serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com
      containers:
      - name: laravel-webapp
        image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
        env:
        - name: APP_NAME
          value: Laravel
        - name: LOG_STACK
          value: stderr
        - name: LOG_STDERR_FORMATTER
          value: "Monolog\\Formatter\\GoogleCloudLoggingFormatter"
        volumeMounts:
          - name: env-file
            # Mount the secret as /.env
-            mountPath: /var/www/html/.env
+           mountPath: /var/www/html
      volumes:
        - name: env-file
          secret:
            secretName: laravel-secret
            items:
              - key: latest
                path: .env

I try the step 2 and I get File not found.

4. I modified step 3 and use env variables instead of mount secret volume.

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: laravel-webapp
  annotations:
    run.googleapis.com/minScale: '1'
spec:
  template:
    metadata:
      name: laravel-webapp-$CI_COMMIT_SHORT_SHA
      annotations:
        run.googleapis.com/cloudsql-instances: $CLOUDSQL_INSTANCES
        run.googleapis.com/network-interfaces: '[{"network": "default", "subnetwork": "default"}]'
        run.googleapis.com/vpc-access-egress: 'private-ranges-only'
    spec:
      serviceAccountName: deployer-cloudrun@<project-id>.iam.gserviceaccount.com
      containers:
      - name: laravel-webapp
        image: $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
        env:
        - name: APP_NAME
          value: Laravel
        - name: APP_KEY
          valueFrom:
            secretKeyRef:
              key: latest
              name: laravel_webapp_app_key
        - name: APP_ENV
          value: production
        - name: APP_DEBUG
          value: "false"

I try the step 4 and IT WORKS!

Then, I take a short conclusion that the serversideup/docker-php cannot read the .env fle that mounted from Cloud Run. Here's my Dockerfile to build the docker image for Laravel project in Cloud Run.

#
# Vendor Dependencies
#
FROM serversideup/php:8.3-cli AS vendor

USER root

ENV COMPOSER_ALLOW_SUPERUSER=1

COPY app /app/app
COPY database /app/database
# COPY helpers /app/helpers/
COPY composer.json /app/composer.json
COPY composer.lock /app/composer.lock

WORKDIR /app

RUN composer install --prefer-dist --no-ansi --no-interaction --no-progress --no-scripts --classmap-authoritative

#
# NPM Dependencies
#
FROM node:18-alpine AS npm

# Install pnpm with corepack
# RUN npm install --global corepack@latest

# RUN corepack enable pnpm

RUN mkdir -p /app/public

COPY package.json vite.config.js package-lock.json /app/
# COPY public/js/ /app/public/js/
# COPY public/css/ /app/public/css/
COPY resources/ /app/resources/

WORKDIR /app

RUN npm install && npm run build

#
# Application container
#

FROM serversideup/php:8.3-fpm-nginx-alpine

USER www-data

# Copies the Laravel app, but skips the ignored files and paths
COPY --chown=www-data:www-data . .
COPY --chown=www-data:www-data --from=vendor /app/vendor/ /var/www/html/vendor/
COPY --chown=www-data:www-data --from=npm /app/public/ /var/www/html/public/

ENV AUTORUN_ENABLED="true" \
    # AUTORUN_LARAVEL_MIGRATION="true" \
    # AUTORUN_LARAVEL_MIGRATION_ISOLATION="true" \
    PHP_OPCACHE_ENABLE="1"

I'm curious, is that possible to mount .env file for laravel project in Cloud Run by using serversideup/php? If it's possible then what's should I change in my Dockerfile? If it's not possible then why?

Thank you.

[jaydrogers]

I've never used Cloud Run before, but I wonder if it is mounting the ENV file as root with 600 permissions and our default user of www-data does not have access to it?

You might have to dive into the docs and see if they support setting the ENV file to a different user

[kresnasatya]

Hi, thanks for replying. I think that’s a reason why I cannot mount the .env file into cloud run containers. Anyway, instead of using mount .env as volume, I will put the .env variables on google secret manager. Thanks.