CloudRun and GKE Autopilot fine using the same image from Artifact or Container Registry

[g3289ds]

My understanding is that when a service is deployed in either CloudRun or GKE the container image is downloaded into an instance by each service and the original image can't be affected by the running container. Due to this there shouldn't be any issues deploying a service with either product pointing to the same image correct? The image won't somehow be corrupted, right? I know two duplicate services  in different products may encounter the problem of trying to access the same database and other functions, but we are concerned something might happen to the container itself stored in either registry.

[alexmoore · Accepted solution]

Your understanding is right, when you deploy referencing an image in Artifact Registry the respective service is simply downloading (or streaming) the image and then starting it up.  The only way it could affect the image stored in the registry is if the code inside the image itself was written in some way (and had permission via the service account identity) to actually modify the registry, but for general use there wouldn't be any expectation of 'corruption' etc.

One other thing to explore is pulling the image by referencing the image digest, this is the sha256 hash value of the image contents. Each version of an image has a unique image digest.  That way if for some reason the image did get modified in some way and the image tag pointed to a new version, your service continues to pull the specific version, rather than the newer one until such point that you update it.

And then if you want to get really advanced you can explore Binary Authorization, which ensures only signed valid images can be deployed: https://cloud.google.com/binary-authorization 

[garisingh]

Correct.  Neither Cloud Run nor GKE modify the images stored in the registry.  Images are always pulled locally to either runtime.