gcloud "run deploy" - Image Not Found or Not Permitted
Cloud Run could not use the container image you pointed it at - the image reference does not exist in the registry, was never pushed, or the service account lacks permission to pull it.
What this error means
gcloud run deploy --image ... fails saying the image was not found or that pulling it was denied. It is deterministic: a wrong tag/digest or a missing pull permission fails the same way until the image is pushed or access is granted.
ERROR: (gcloud.run.deploy) Image 'us-docker.pkg.dev/my-proj/repo/app:latest'
not found.
# or
ERROR: ... denied: Permission "artifactregistry.repositories.downloadArtifacts"
denied on resourceCommon causes
Image not pushed or wrong reference
The --image tag/digest does not exist in Artifact Registry - the build/push step was skipped, the tag is wrong, or you referenced an old gcr.io path that no longer holds it.
Service account cannot pull the image
Cloud Run’s runtime service account needs roles/artifactregistry.reader on the repo. Without it, the pull is denied even though the image exists.
How to fix it
Push the image, then deploy by digest
Build and push to Artifact Registry, then deploy the exact image reference.
docker push us-docker.pkg.dev/my-proj/repo/app:1.2.3
gcloud run deploy app --image us-docker.pkg.dev/my-proj/repo/app:1.2.3 \
--region us-central1Grant the runtime SA pull access
Give the Cloud Run service account read access to the Artifact Registry repo.
gcloud artifacts repositories add-iam-policy-binding repo \
--location us-central1 \
--member="serviceAccount:RUNTIME_SA@my-proj.iam.gserviceaccount.com" \
--role="roles/artifactregistry.reader"How to prevent it
- Push images to Artifact Registry and deploy by immutable digest, not
:latest. - Grant the Cloud Run runtime SA
artifactregistry.readeron the repo. - Build-and-push before deploy in the same pipeline so the image always exists.